Docker Registry:
I finally had the time to respond @rameerez.
If paying an extra $5-20 is an issue, Kamal is not for you, you are likely better on Heroku, Fly.io, Render, etc, until your bills there reach a point to make sense to use Kamal. But there are plans to move the container registry to the host in the future.
"You need to keep your local Docker install up to date"
You need to keep every software up to date :) Switch to Linux or make Docker work better on MacOS are options for the performance problems.
"moby/buildkit, which currently has critical security vulnerabilities"
Do you have a link tho those?
"If your machine is not powerful enough..."
I don't experience this. For development you will need a powerful machine anyways unfortunately.
"Kamal is full of things that kinda work but not really: my M1 can’t compile for x86_64 arch"
You have options here. You can build remotely or use the same architecture locally.
"You need to manually configure a Postgres container accessory if you wanna run Postgres"
Some people use managed Postgres and doesn't need the accessory. Configuring it is really low effort.
"Even with all of the above solved, I’d still need solutions to problems I currently solve easily with a simple Nginx setup file"
I am sure, back in the day, you also had to invest some time to figure out how to do so with Nginx.
"Deploy times are longer than Capistrano: you need to build the image"
My deploy time is faster than capistrano, but I use linux, so the build is very fast.
"In general, Docker just adds another layer between you and the code:"
This is a fair point, but it brings value too.
"Kamal solves nothing for me but adds a gigantic list of new problems that I now have to worry about "
The good thing is, it is optional!
"I spent 4h last night trying to deploy a clean Rails 8 app. I failed miserably. Couldn't get anything deployed
And I'm fairly experienced with Rails,"
I consider myself a mediocre Rails developer(except when I negotiate day rates :)). I didn't like Docker and barely used it before Kamal. Yet, I managed to solve all the problems I faced and surely didn't spend 4 hours to deploy the first app. And wrote blog posts about using Kamal to help others facing the same issues I did. I believe that moves us forward.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
3 simple Rails security improvements you can do with a few minutes investment:
🧵👇
Even though Rails has secure defaults, there are still plenty of ways to shoot yourself in the leg, or to get compromised.
If you incorporate these 3 simple changes to your application, you will level up your application's security posture.
Setup dependency vulnerability monitoring.
Using dependencies with known vulnerabilities is a huge security risk.
To mitigate this, you can setup a Github action to run bundle audit and yarn audit on your codebase regularly and patch when needed.
One of Ruby's great features is method chaining.
For instance, Active Record heavily relies on this and method chaining enables us to do cool things like User.where("active = 1").count.
Have you ever wondered how is that possible?
Let's look into it, it is pretty simple.
🧵👇
Let's use a simple example of having a user model and you want to be able to set a default password for your user when they signup via OAuth. So you want to be able to do something like this in your controller:
Then in your model you would implement the set_password method: