Building Enterprise Storage, Backups & Cosign Image Security in Go & Flutter with Google Antigravity Gubernator (gbnt), a container orchestrator, has integrated enterprise-grade storage, backup, and image security features in versions v2.24.0 and v2.25.0, with the assistance of Google Antigravity (AGY) as an autonomous AI engineering partner. The new subsystems include a shared mobility pool for persistent volumes, atomic freeze backups for consistent snapshots, and a pre-deployment admission gatekeeper for Cosign image signature verification. When architecting a modern container orchestrator like Gubernator gbnt — designed to strike the In this article, we break down how we designed and implemented these two major subsystems in Gubernator v2.24.0 & v2.25.0 , and how we leveraged Google Antigravity AGY as an autonomous AI engineering partner to architect, implement, test, and live-deploy Full-Stack features Go + SQLite + Flutter Web + CLI across a live 3-node multi-host cluster. Stateful container workloads present a fundamental orchestration challenge: how can a container move between different physical hosts while maintaining access to its persistent disk storage? ┌─────────────────────────────────────────────────────────────────────────┐ │ GUBERNATOR STORAGE & BACKUP ENGINE │ ├─────────────────────────────────────────────────────────────────────────┤ │ /var/contenedores Shared Mobility Pool: NFS, GlusterFS, CephFS │ │ Point-in-Time Compressed Tarballs .tar.gz + SHA-256 Checksums │ │ Background Cron Scheduler & Automated Retention Pruning │ │ Zero-Downtime Consistent Freeze docker pause - tar - unpause │ └─────────────────┬───────────────────────────────────┬───────────────────┘ │ │ ▼ ▼ ┌─────────────────────────┐ ┌─────────────────────────┐ │ Centurion 1 Manager │ │ Centurion 2 Worker 1 │ │ IP: 192.168.252.27 │ │ IP: 192.168.252.25 │ │ Mount: /var/contened.. │ │ Mount: /var/contened.. │ └─────────────────────────┘ └─────────────────────────┘ /var/contenedores Gubernator standardizes volume mobility by designating /var/contenedores across all cluster nodes. When backed by a distributed file system NFS, GlusterFS, CephFS, CIFS or localized volumes: used / total , percentage, and node read/write mount health .Backing up a running relational database PostgreSQL, MariaDB, SQLite while active transactions are in flight risks data corruption. We implemented an optional Atomic Freeze Strategy : // internal/storage/backup.go func CreateBackup name, targetPath, stackName, serviceName string, pauseContainer bool db.Backup, error { if pauseContainer && containerID = "" { slog.Info "backup: pausing container for consistent snapshot", "container", containerID = dockerClient.ContainerPause ctx, containerID defer dockerClient.ContainerUnpause ctx, containerID } // Stream directory to tar.gz with SHA-256 calculation archiveFile, sha256Checksum, sizeBytes, err := archiveDirectory targetPath, destFile if err = nil { return nil, err } // ... Save record to SQLite ... } Gubernator's background backup daemon evaluates standard cron expressions e.g. 0 2 for nightly 2:00 AM backups and automatically prunes older snapshots according to a configured retention count e.g. keep last 7 copies . Deploying third-party container images blindly introduces severe supply-chain risks. In v2.25.0 , we introduced a complete Pre-Deployment Admission Gatekeeper : Stack Deploy / Container Run Request │ ▼ ┌──────────────────────────────────────────────────┐ │ GUBERNATOR ADMISSION GATEKEEPER Port 4000 │ │ - Evaluates Cluster & Stack Security Policy │ └────────────────────────┬─────────────────────────┘ │ ┌───────────────────────────────┴───────────────────────────────┐ ▼ ▼ ┌───────────────────────────┐ ┌───────────────────────────┐ │ 1. Cryptographic Sign │ │ 🔍 2. CVE Vulnerability │ │ Cosign / Sigstore │ │ Scanning & CVSS Scores │ ├───────────────────────────┤ ├───────────────────────────┤ │ Is the image signed with │ │ Does image exceed Max │ │ a trusted cluster key? │ │ Severity Critical/High ? │ └─────────────┬─────────────┘ └─────────────┬─────────────┘ │ │ ├───────── ❌ Unsigned / Invalid ├───────── ❌ Exceeds Threshold │ If policy = 'ENFORCE' │ If policy = 'BLOCK' ▼ ▼ ╔═══════════════════════════╗ ╔═══════════════════════════╗ ║ ⛔ DEPLOYMENT REJECTED ║ ║ ⛔ DEPLOYMENT BLOCKED ║ ║ "Signature check failed" ║ ║ "Found 2 Critical CVEs" ║ ╚═══════════════════════════╝ ╚═══════════════════════════╝ │ │ └──────────────────────────┬──────────────────────────────────┘ │ ✅ Passes All Admission Checks ▼ ╔═════════════════════════════════╗ ║ 🚀 Container Scheduled on Hosts ║ ╚═════════════════════════════════╝ To eliminate heavy external binary dependencies like cosign or CGO toolchains, we implemented the cryptographic signing engine using Go's standard library crypto/ecdsa , crypto/elliptic , crypto/x509 , crypto/sha256 : // internal/security/signing.go func GenerateCosignKeypair name string pubPEM string, privPEM string, err error { privKey, err := ecdsa.GenerateKey elliptic.P256 , rand.Reader if err = nil { return "", "", err } privBytes, := x509.MarshalECPrivateKey privKey privPEMBlock := &pem.Block{Type: "EC PRIVATE KEY", Bytes: privBytes} privPEM = string pem.EncodeToMemory privPEMBlock pubBytes, := x509.MarshalPKIXPublicKey &privKey.PublicKey pubPEMBlock := &pem.Block{Type: "PUBLIC KEY", Bytes: pubBytes} pubPEM = string pem.EncodeToMemory pubPEMBlock return pubPEM, privPEM, nil } For software inventory audits and compliance, Gubernator automatically analyzes container image layers, extracts packages and OS libraries musl, glibc, OpenSSL, busybox , and exports standardized Software Bill of Materials in: Rather than requiring users to register images manually, Gubernator continuously discovers all container images running across every node in the cluster Manager , Worker 1 , Worker 2 . The UI dynamically renders host badges and service tags indicating where every container instance is hosted. Gubernator's Web Dashboard Port 4001 provides two rich Material Design 3 interfaces: .tar.gz browser downloads, and backup restore modals. Used in: caddy, promtail on Manager, Worker 1, Worker 2 . Audit / Warn Only vs Strict Enforcement , CVE severity threshold blocking .Every capability is accessible directly through the gbnt CLI: === Storage & Backups === gbnt volume ls gbnt backup ls gbnt backup create --name "postgres-nightly" --pause /var/contenedores/postgres gbnt backup restore