Security and Deployment

54.1 Security

Use run with separate arguments instead of shell with interpolated strings EVAL with untrusted input

Never do it (that's why MONKEY-SEE-NO-EVAL is required); parse input with grammars instead DBIish placeholders (?), Red ORM

Validate paths (.IO.resolve, check the prefix), reject .. Untrusted data parsing

Grammars with explicit structure, subsets/constraints for validation

Environment variables (%*ENV), secret managers; never commit credentials

IO::Socket::Async::SSL, Cro with TLS configuration, verify certificates

Pin versions in depends (:ver<1.2.3>), review ecosystem modules, use auth constraints

Avoid shared mutable state; use Locks/atomics/Channels

54.2 Deployment

Distribute CLI tools as zef distributions (scripts in bin/ are installed into PATH) or Docker images. Use systemd or containers for long-running Cro services. Keep .precomp caches warm in images to reduce startup time.

CI: GitHub Actions with Raku/setup-raku, then zef install --deps-only . and zef test . (or prove6 -l t).

FROM rakudo-star:latest
WORKDIR /app
COPY META6.json .
RUN zef install --deps-only --/test .
COPY . .
RUN raku -c -Ilib bin/service    # precompile/check at build time
EXPOSE 10000
CMD ["raku", "-Ilib", "bin/service"]