[kit-layout][Audit 2026-04-14] Docker build/runtime mismatch

[yanghao1143]

Summary

go-saas/kit-layout issues are disabled; tracking this audit item in go-saas/kit.

Findings (kit-layout)

• High | confirmed Docker EXPOSE ports (8000/9000) mismatch runtime listen ports (9500/9501).
  • Evidence: kit-layout/Dockerfile:20, :21, kit-layout/configs/config.yaml:10, :12
• High | probable Docker CMD may not match build output binary naming.
  • Evidence: kit-layout/Makefile:27, kit-layout/Dockerfile:24

Suggested Direction

• Align EXPOSE/health probes with actual service ports.
• Build a fixed binary name and match CMD.