litestar-deployment
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches
uvpackage manager binaries from Astral's official GitHub Container Registry. - [EXTERNAL_DOWNLOADS]: Downloads
bunruntime binaries from Oven's official Docker Hub repository. - [EXTERNAL_DOWNLOADS]: Utilizes Google's official distroless base images (
gcr.io/distroless) for production containers to minimize the attack surface. - [COMMAND_EXECUTION]: Orchestrates build and deployment workflows using standard CLI tools including
uv,bun,litestar,gcloud, andkubectl. - [PRIVILEGE_ESCALATION]: Implements security hardening by enforcing non-root user execution (UID 65532) and utilizing Kubernetes pod security contexts (
runAsNonRoot: true,allowPrivilegeEscalation: false). - [DYNAMIC_EXECUTION]: Performs architecture-aware library copying during multi-stage Docker builds to facilitate self-contained runtimes in shell-less (distroless) environments.
- [CREDENTIALS_SAFE]: Correctly identifies that secrets such as
DATABASE_URLandSECRET_KEYshould be managed via environment variables or secret managers rather than being hardcoded in Dockerfiles or configuration.
Audit Metadata