litestar-deployment

Pass

Audited by Gen Agent Trust Hub on Oct 26, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: Fetches uv package manager binaries from Astral's official GitHub Container Registry.
  • [EXTERNAL_DOWNLOADS]: Downloads bun runtime binaries from Oven's official Docker Hub repository.
  • [EXTERNAL_DOWNLOADS]: Utilizes Google's official distroless base images (gcr.io/distroless) for production containers to minimize the attack surface.
  • [COMMAND_EXECUTION]: Orchestrates build and deployment workflows using standard CLI tools including uv, bun, litestar, gcloud, and kubectl.
  • [PRIVILEGE_ESCALATION]: Implements security hardening by enforcing non-root user execution (UID 65532) and utilizing Kubernetes pod security contexts (runAsNonRoot: true, allowPrivilegeEscalation: false).
  • [DYNAMIC_EXECUTION]: Performs architecture-aware library copying during multi-stage Docker builds to facilitate self-contained runtimes in shell-less (distroless) environments.
  • [CREDENTIALS_SAFE]: Correctly identifies that secrets such as DATABASE_URL and SECRET_KEY should be managed via environment variables or secret managers rather than being hardcoded in Dockerfiles or configuration.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 26, 2026, 08:15 AM