rails-devops-patterns

Rails DevOps Patterns

Analyze and recommend best practices for Rails deployment, containerization, CI/CD, monitoring, security, and production optimization.

Follow standard Docker, CI/CD, and Puma conventions. Focus on the opinionated Rails-specific patterns below.

See patterns.md for full configuration examples.

Quick Reference

Area	Key Files	Tool/Service
Docker	Dockerfile, docker-compose.yml	Docker, BuildKit
CI/CD	.github/workflows/ci.yml	GitHub Actions
Server	config/puma.rb	Puma
Security	config/initializers/rack_attack.rb	Rack::Attack
Monitoring	config/environments/production.rb	Lograge, structured JSON
Deploy	bin/deploy, config/deploy/	Kamal, Capistrano

Core Principles

1. Immutable deploys: Build once, deploy the same artifact everywhere
2. Non-root containers: Always run as a non-root USER in production
3. Health checks at /up: Load balancers and orchestrators need them
4. Structured JSON logging: Machine-parseable logs to STDOUT
5. Defense in depth: SSL + rate limiting + CSP headers + statement timeouts

Production Dockerfile (Alpine, Non-Root)

The key non-obvious elements: SECRET_KEY_BASE=precompile_placeholder for asset compilation, non-root user, and HEALTHCHECK directive.

# syntax=docker/dockerfile:1
FROM ruby:3.2-alpine AS base
RUN apk add --no-cache postgresql-dev tzdata gcompat
WORKDIR /app
ENV RAILS_ENV=production \
    BUNDLE_DEPLOYMENT=true \
    BUNDLE_WITHOUT="development:test"

FROM base AS build
RUN apk add --no-cache build-base git
COPY Gemfile Gemfile.lock ./
RUN bundle install --jobs 4 --retry 3
# Only install Node deps if package.json exists (skip for importmap apps)
COPY package.json* yarn.lock* ./
RUN if [ -f package.json ]; then apk add --no-cache nodejs yarn && yarn install --production --frozen-lockfile; fi
COPY . .
RUN SECRET_KEY_BASE=precompile_placeholder bundle exec rails assets:precompile

FROM base AS runtime
COPY --from=build /usr/local/bundle /usr/local/bundle
COPY --from=build /app /app
RUN addgroup -S rails && adduser -S rails -G rails && \
    chown -R rails:rails /app
USER rails
EXPOSE 3000
HEALTHCHECK --interval=30s --timeout=3s CMD wget -qO- http://localhost:3000/up || exit 1
CMD ["bundle", "exec", "puma", "-C", "config/puma.rb"]