control plane
Fact1 (Go + chi)
Case Study
Updated: 2026-10-04ForgeLAB — Self-Hosted Application Deployment Platform
A single control-plane application deployment platform built in Go that orchestrates the entire container deployment lifecycle: direct local-directory ingestion, heuristic runtime framework detection, multi-stage Docker builds, dynamic host and container port mapping (10000–60000), health/readiness check gating, live WebSocket log streaming with Redis Pub/Sub, AES-256-GCM secret and OAuth token encryption, and rollback safety.
Scope: full stackSystems & Cloud Infrastructure EngineerDuration: 4 monthsYear: 2026Architecture: platform
Repository Links:
Key Engineering Facts & Architecture Specs
Structural Invariantsport range
Fact10000-60000
crypto standard
FactAES-256-GCM
pubsub queue
FactRedis 7 (LPUSH/BRPOP)
database
FactPostgreSQL 16
Architecture View
Processing state: architecture signal graph is initializing...
Architectural Decision Log
Trade-Off AnalysisDirect local source ingestion without browser upload
Ingesting code directly from host directories with .dockerignore pruning eliminates redundant browser file transfers and disk duplication for self-hosted developer workflows.
Trade-off: Requires backend direct read access to host filesystem paths and rigorous PathValidator root-boundary enforcement to prevent directory traversal.
Strict Docker Engine trust boundaries and capability dropping
Dropping ALL capabilities, setting no-new-privileges, enforcing CPU/RAM/PID limits, and blocking /var/run/docker.sock prevents container escape attacks in multi-tenant or self-hosted workloads.
Trade-off: Prevents privileged Docker-in-Docker workflows unless explicitly bridged via isolated worker architectures.
Atomic lease ownership and rollback safety invariant
Using Redis atomic leases with cryptographically unique execution tokens ensures that failed releases never terminate or replace healthy, running container instances.
Trade-off: Requires dedicated readiness probe polling and rollback state-machine transitions before promoting new containers to active traffic.
Architecture Narrative
Challenge
Building a self-hosted PaaS platform requires orchestrating container builds, port allocations, live log streams, and secret management without introducing privilege escalation vulnerabilities or breaking running applications during failed releases.
Solution
Built a Go control plane using the Docker Engine SDK with strict trust boundary enforcement (no-new-privileges, capability dropping, path validation). Orchestrated asynchronous deployment workers via Redis LPUSH/BRPOP with cryptographically signed leases, streamed build and container logs over WebSockets via Redis Pub/Sub, encrypted all sensitive credentials and environment secrets with AES-256-GCM, and mapped dynamic host ports between 10000 and 60000.
Result
Delivered a complete, verified local-deployment platform with sub-second health and readiness check gating, zero-downtime rollback safety, and a unified Next.js dashboard for controlling multi-service project environments.
Trade-off Matrix
| Dimension | Selected Option | Impact | Compromise |
|---|---|---|---|
| Source Ingestion | Host Path Streaming with PathValidator | Zero upload overhead and instant context building | Requires strict allowed-root path sanitization |
| Worker Coordination | Redis LPUSH/BRPOP with Atomic Lease Tokens | Fault-tolerant job distribution with automatic worker recovery | Redis runtime dependency required alongside PostgreSQL |
| Container Security | Full Capability Drop (ALL) + no-new-privileges | Hardened isolation against container breakout | Disallows running privileged system containers |
Failure Modes & Resilience Analysis
Degradation ProtocolFailure Path & Recovery Invariants
If an in-flight deployment fails build compilation, health-check probes, or container initialization, the system marks the deployment failed, releases the dynamic port lease, and preserves the prior healthy container without interrupting user traffic.
What I'd Do Differently & Evolution
+
Add eBPF-based container network observability for real-time bandwidth metrics per deployed service.
+
Introduce distributed artifact caching across builds using BuildKit remote cache exporters.