{"slug": "building-enterprise-storage-backups-cosign-image-security-in-go-flutter-with", "title": "Building Enterprise Storage, Backups & Cosign Image Security in Go & Flutter with Google Antigravity", "summary": "Gubernator (gbnt), a container orchestrator, has integrated enterprise-grade storage, backup, and image security features in versions v2.24.0 and v2.25.0, with the assistance of Google Antigravity (AGY) as an autonomous AI engineering partner. The new subsystems include a shared mobility pool for persistent volumes, atomic freeze backups for consistent snapshots, and a pre-deployment admission gatekeeper for Cosign image signature verification.", "body_md": "When architecting a modern container orchestrator like ** Gubernator (gbnt)** — designed to strike the\n\nIn this article, we break down how we designed and implemented these two major subsystems in **Gubernator v2.24.0 & v2.25.0**, and how we leveraged **Google Antigravity (AGY)** as an autonomous AI engineering partner to architect, implement, test, and live-deploy Full-Stack features (Go + SQLite + Flutter Web + CLI) across a live 3-node multi-host cluster.\n\nStateful container workloads present a fundamental orchestration challenge: **how can a container move between different physical hosts while maintaining access to its persistent disk storage?**\n\n```\n ┌─────────────────────────────────────────────────────────────────────────┐\n │                   GUBERNATOR STORAGE & BACKUP ENGINE                     │\n ├─────────────────────────────────────────────────────────────────────────┤\n │   /var/contenedores (Shared Mobility Pool: NFS, GlusterFS, CephFS)    │\n │   Point-in-Time Compressed Tarballs (.tar.gz) + SHA-256 Checksums     │\n │   Background Cron Scheduler & Automated Retention Pruning            │\n │   Zero-Downtime Consistent Freeze (docker pause -> tar -> unpause)    │\n └─────────────────┬───────────────────────────────────┬───────────────────┘\n                   │                                   │\n                   ▼                                   ▼\n      ┌─────────────────────────┐         ┌─────────────────────────┐\n      │  Centurion 1 (Manager)  │         │  Centurion 2 (Worker 1) │\n      │   IP: 192.168.252.27    │         │   IP: 192.168.252.25    │\n      │  Mount: /var/contened.. │         │  Mount: /var/contened.. │\n      └─────────────────────────┘         └─────────────────────────┘\n```\n\n`/var/contenedores`\n\n)\nGubernator standardizes volume mobility by designating `/var/contenedores`\n\nacross all cluster nodes. When backed by a distributed file system (NFS, GlusterFS, CephFS, CIFS) or localized volumes:\n\n`used / total`\n\n, percentage, and node read/write mount health).Backing up a running relational database (PostgreSQL, MariaDB, SQLite) while active transactions are in flight risks data corruption.\n\nWe implemented an optional **Atomic Freeze Strategy**:\n\n```\n// internal/storage/backup.go\nfunc CreateBackup(name, targetPath, stackName, serviceName string, pauseContainer bool) (*db.Backup, error) {\n    if pauseContainer && containerID != \"\" {\n        slog.Info(\"backup: pausing container for consistent snapshot\", \"container\", containerID)\n        _ = dockerClient.ContainerPause(ctx, containerID)\n        defer dockerClient.ContainerUnpause(ctx, containerID)\n    }\n\n    // Stream directory to tar.gz with SHA-256 calculation\n    archiveFile, sha256Checksum, sizeBytes, err := archiveDirectory(targetPath, destFile)\n    if err != nil {\n        return nil, err\n    }\n    // ... Save record to SQLite ...\n}\n```\n\nGubernator's background backup daemon evaluates standard cron expressions (e.g. `0 2 * * *`\n\nfor nightly 2:00 AM backups) and automatically prunes older snapshots according to a configured retention count (e.g. keep last 7 copies).\n\nDeploying third-party container images blindly introduces severe supply-chain risks. In **v2.25.0**, we introduced a complete **Pre-Deployment Admission Gatekeeper**:\n\n```\n                         [ Stack Deploy / Container Run Request ]\n                                          │\n                                          ▼\n                 ┌──────────────────────────────────────────────────┐\n                 │     GUBERNATOR ADMISSION GATEKEEPER (Port 4000)   │\n                 │     - Evaluates Cluster & Stack Security Policy  │\n                 └────────────────────────┬─────────────────────────┘\n                                          │\n          ┌───────────────────────────────┴───────────────────────────────┐\n          ▼                                                               ▼\n ┌───────────────────────────┐                                 ┌───────────────────────────┐\n │  1. Cryptographic Sign  │                                 │ 🔍 2. CVE Vulnerability   │\n │    (Cosign / Sigstore)    │                                 │    Scanning & CVSS Scores │\n ├───────────────────────────┤                                 ├───────────────────────────┤\n │ Is the image signed with  │                                 │ Does image exceed Max     │\n │ a trusted cluster key?    │                                 │ Severity (Critical/High)? │\n └─────────────┬─────────────┘                                 └─────────────┬─────────────┘\n               │                                                             │\n               ├───────── ❌ Unsigned / Invalid                              ├───────── ❌ Exceeds Threshold\n               │          (If policy = 'ENFORCE')                            │          (If policy = 'BLOCK')\n               ▼                                                             ▼\n ╔═══════════════════════════╗                                 ╔═══════════════════════════╗\n ║  ⛔ DEPLOYMENT REJECTED   ║                                 ║   ⛔ DEPLOYMENT BLOCKED   ║\n ║ \"Signature check failed\"  ║                                 ║ \"Found 2 Critical CVEs\"   ║\n ╚═══════════════════════════╝                                 ╚═══════════════════════════╝\n               │                                                             │\n               └──────────────────────────┬──────────────────────────────────┘\n                                          │ ✅ Passes All Admission Checks\n                                          ▼\n                         ╔═════════════════════════════════╗\n                         ║ 🚀 Container Scheduled on Hosts ║\n                         ╚═════════════════════════════════╝\n```\n\nTo eliminate heavy external binary dependencies like `cosign`\n\nor CGO toolchains, we implemented the cryptographic signing engine using Go's standard library (`crypto/ecdsa`\n\n, `crypto/elliptic`\n\n, `crypto/x509`\n\n, `crypto/sha256`\n\n):\n\n```\n// internal/security/signing.go\nfunc GenerateCosignKeypair(name string) (pubPEM string, privPEM string, err error) {\n    privKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)\n    if err != nil {\n        return \"\", \"\", err\n    }\n\n    privBytes, _ := x509.MarshalECPrivateKey(privKey)\n    privPEMBlock := &pem.Block{Type: \"EC PRIVATE KEY\", Bytes: privBytes}\n    privPEM = string(pem.EncodeToMemory(privPEMBlock))\n\n    pubBytes, _ := x509.MarshalPKIXPublicKey(&privKey.PublicKey)\n    pubPEMBlock := &pem.Block{Type: \"PUBLIC KEY\", Bytes: pubBytes}\n    pubPEM = string(pem.EncodeToMemory(pubPEMBlock))\n\n    return pubPEM, privPEM, nil\n}\n```\n\nFor software inventory audits and compliance, Gubernator automatically analyzes container image layers, extracts packages and OS libraries (musl, glibc, OpenSSL, busybox), and exports standardized Software Bill of Materials in:\n\nRather than requiring users to register images manually, Gubernator continuously discovers all container images running across every node in the cluster (`Manager`\n\n, `Worker 1`\n\n, `Worker 2`\n\n). The UI dynamically renders **host badges and service tags** indicating where every container instance is hosted.\n\nGubernator's Web Dashboard (Port 4001) provides two rich Material Design 3 interfaces:\n\n`.tar.gz`\n\nbrowser downloads, and backup restore modals.`Used in: caddy, promtail on Manager, Worker 1, Worker 2`\n\n).`Audit / Warn Only`\n\nvs `Strict Enforcement`\n\n, CVE severity threshold blocking).Every capability is accessible directly through the `gbnt`\n\nCLI:\n\n```\n# === Storage & Backups ===\ngbnt volume ls\ngbnt backup ls\ngbnt backup create --name \"postgres-nightly\" --pause /var/contenedores/postgres\ngbnt backup restore <backup-id> --target /var/contenedores/postgres\n\n# === Image Security & SBOM ===\ngbnt scan\ngbnt scan postgres:16-alpine\ngbnt sbom postgres:16-alpine --format cyclonedx-json > sbom.json\n\n# === Cosign Signing & Verification ===\ngbnt security key generate --name \"prod-release-key\"\ngbnt image sign company/payments:2.1.0 --key /path/to/private.key\ngbnt image verify company/payments:2.1.0\n\n# === Cluster Gatekeeper Policy ===\ngbnt security policy\n```\n\nBuilding a distributed orchestrator with state synchronization, cryptographic operations, cross-compilation, and Full-Stack Web UIs is an intricate endeavor. Here is how **Google Antigravity** accelerated development:\n\nBefore writing code, we used Antigravity to formalize comprehensive architectural blueprints:\n\nHaving structured specifications allowed the AI to implement the entire pipeline (GORM database schemas, pure Go cryptography, REST API routes, Flutter Dart models, and CLI flags) with complete architectural alignment.\n\nDuring initial testing of the backup scheduler, we encountered a recursive mutex deadlock: `StartBackupScheduler()`\n\nwas holding `cronMutex.Lock()`\n\nwhile calling `SyncSchedules()`\n\n, which also attempted to acquire `cronMutex.Lock()`\n\n. Antigravity inspected the call graph, refactored `syncSchedulesLocked()`\n\n, and verified thread-safety without human intervention.\n\nAntigravity seamlessly built Linux ARM64 binaries (`CGO_ENABLED=0 GOOS=linux GOARCH=arm64`\n\n), transferred them to a live 3-node Multipass virtualized cluster (`gbnt-manager`\n\n, `gbnt-worker1`\n\n, `gbnt-worker2`\n\n), and executed live HTTP and CLI verification checks against Port 4000, 4001, and 4002.\n\nWith **Storage & Backups (v2.24.0)** and **Image Security & Cosign (v2.25.0)**, Gubernator bridges the gap between lightweight simplicity and enterprise-grade resilience.\n\nWhether you are running a single-node homelab or an edge-distributed cluster, you can now:\n\nExplore the project on GitHub:\n\n[GitHub: mario-ezquerro/gubernator](https://github.com/mario-ezquerro/gubernator)\n\n[Official Documentation & Guides](https://mario-ezquerro.github.io/gubernator/)\n\n*Have you implemented image signing or shared volume mobility in your container setups? Share your thoughts in the comments below!*", "url": "https://wpnews.pro/news/building-enterprise-storage-backups-cosign-image-security-in-go-flutter-with", "canonical_source": "https://dev.to/gde/building-enterprise-storage-backups-cosign-image-security-in-go-flutter-with-google-antigravity-3ao3", "published_at": "2026-08-20 18:13:27+00:00", "updated_at": "2026-08-20 18:44:37.625021+00:00", "lang": "en", "topics": ["ai-tools", "developer-tools", "artificial-intelligence"], "entities": ["Gubernator", "Google Antigravity", "Cosign", "Go", "Flutter", "SQLite", "NFS", "GlusterFS"], "alternates": {"html": "https://wpnews.pro/news/building-enterprise-storage-backups-cosign-image-security-in-go-flutter-with", "markdown": "https://wpnews.pro/news/building-enterprise-storage-backups-cosign-image-security-in-go-flutter-with.md", "text": "https://wpnews.pro/news/building-enterprise-storage-backups-cosign-image-security-in-go-flutter-with.txt", "jsonld": "https://wpnews.pro/news/building-enterprise-storage-backups-cosign-image-security-in-go-flutter-with.jsonld"}}