🐹Intermediate10 minBackend

Deploy a Go service from a private repo

Build a single static Go binary with go.mod resolution, authenticate to a private repo via Vault, and run it over SSH — including the trailing-whitespace gotcha that bites everyone once.

What you'll build

A single static Go binary running on your node
Private-module access via a Git token sealed in Vault
A multi-stage build that ships ~15 MB, not a 900 MB toolchain

Before you begin

A registered node
A Go service with a valid go.mod (Go 1.20+)
A Git token if any module is in a private repo

Upload the Go application

Open Development → Deploy → Go. Step 2 takes a .zip of the service. Zip from the module root so go.mod sits at the archive top level.

app.prodxcloud.com/dashboard/development

Deploy Go — Upload application

Server

Upload

Settings

Resources

Application zip

payments-svc.zip

Step 2 — zip from the directory containing go.mod, not its parent.

The trailing-whitespace gotcha

If a private module URL in go.mod has a trailing space or stray CR (common after a copy-paste or a Windows editor), go mod download fails with a cryptic unknown revision. Run gofmt -w go.mod and strip CRLF before zipping.

Set entry point, go.mod, and Go version

Step 3 — point at the entry file (main.go or cmd/server/main.go), the module file, the port, and the Go version. For private modules, add the Git token here; it’s sealed to workspaces/<org>/<workspace>/git/github_token and exported as GOPRIVATE auth during the build only.

app.prodxcloud.com/dashboard/development

Deploy Go — Application settings

Server

Upload

Settings

Resources

Entry point

cmd/server/main.go

Module file

go.mod

Go version

1.22▾

App port / HTTP

8080 / 80

Environment variables

GIN_MODE=release

Step 3 — cmd/server/main.go is the convention for non-trivial services.

Understand the multi-stage build

The pipeline builds in one stage and ships in a tiny one. Knowing the shape helps you debug a failed build:

Dockerfile (generated)

FROM golang:1.22 AS build
WORKDIR /src
COPY . .
RUN go mod download && go build -o /bin/server ./cmd/server

FROM debian:bookworm-slim
COPY --from=build /bin/server /bin/server
ENTRYPOINT ["/bin/server"]

A failing build is almost always step one

90% of Go deploy failures are go mod download (private auth or the whitespace gotcha) or a build error. The runtime stage rarely fails — it’s just a binary.

Deploy and confirm the binary is live

Deployment progress100%

Unpack zip + resolve Git token20%
go mod download45%
go build → static binary75%
Run binary over SSH + Nginx proxy100%

The shipped image is the slim runtime — typically 10–20 MB.

bash

$ curl -s https://payments-svc.<node-domain>/healthzok$ $ ssh ubuntu@<node-ip> "ls -lh /bin/server"-rwxr-xr-x 1 root root 14M /bin/server

Tiny, fast, private-repo-aware

One static binary, private modules resolved through Vault. Next: package anything else as Compose.

Nice work — you're done!

You completed Deploy a Go service from a private repo. Keep the momentum going with the next walkthrough, or jump back to the full catalog.

Next: Custom Service — write any docker-compose.yml All tutorials

Deploy a FastAPI service with managed Postgres Custom Service — write any docker-compose.yml