github.com/zeromicro/go-zero

Go-zero provides a comprehensive microservices toolkit with strong opinions about structure and patterns. The built-in connection pooling for Redis and SQL is solid, with sensible defaults (100 max idle conns, 1000 max open for SQL). The circuit breaker and adaptive load shedding work well under load, though you need to tune the shedding threshold based on your traffic patterns.

The logging hooks integrate cleanly with OpenTelemetry, and the built-in metrics collection (via Prometheus) requires minimal setup. Request tracing propagates automatically through RPC calls. However, the framework's code generation tooling (goctl) creates a lot of boilerplate that becomes difficult to customize when your needs diverge from the standard patterns.

Resource management is generally excellent - graceful shutdown works reliably, and timeout configurations cascade properly through contexts. The default 3-second timeout on RPC calls caught us off guard initially. Breaking changes between minor versions have been minimal since 1.4, though the API surface is large enough that dependency updates require careful testing.

go-zero provides a solid foundation for building microservices with reasonable security defaults baked in. The framework includes automatic request signature validation, built-in rate limiting, and JWT authentication middleware that's straightforward to configure. The code generation tools (goctl) produce services with input validation via struct tags, though you'll want to add custom validators for complex business logic.

The automatic parameter binding includes basic SQL injection protection and the framework enforces timeouts across all service calls by default. Error handling is somewhat opinionated - it automatically wraps errors in structured responses, which is good for consistency but can leak stack traces in non-production environments if you're not careful with the logging configuration.

Dependency management is reasonable with a focused set of core dependencies, though the framework does pull in etcd and grpc libraries even if you're only building REST services. The team responds to CVEs fairly quickly, and TLS configuration for gRPC services uses modern defaults (TLS 1.2+ with strong cipher suites). The middleware chain makes it easy to add custom authorization logic without bypassing framework protections.

go-zero provides a comprehensive microservices framework with impressive code generation capabilities through goctl. The API definition files (.api for HTTP, .proto for gRPC) generate complete service skeletons, reducing boilerplate significantly. Once you understand the conventions, building services becomes very productive. The built-in middleware for tracing, metrics, and circuit breaking work well out of the box.

The framework is heavily opinionated about project structure, which helps consistency but requires investment to understand their way of doing things. Documentation has improved but still assumes familiarity with microservices patterns. The English documentation can be sparse, though Chinese docs are more comprehensive. Error messages from goctl are generally helpful, pointing to line numbers in .api files when definitions are malformed.

Community support is active on GitHub issues with maintainers responding within days. Stack Overflow coverage is limited, so you'll rely more on GitHub discussions and examples. The framework shines when building distributed systems with service discovery and resilience patterns, but feels heavyweight for simple REST APIs.