This document discusses best practices for configuring Docker containers for Ruby on Rails applications hosted on DigitalOcean. It recommends using environment variables stored in files like Figaro or Dotenv for database credentials and other config, avoiding secrets in Dockerfiles, bundling gems before building images, and running the app command in the container.

1. Docker at DigitalOcean
Tommy Murphy

2. why

3. FROM ruby:2.2.0
RUN apt-get update -qq && apt-get install -y build-essential libpq-dev
RUN mkdir /myapp
WORKDIR /myapp
ADD Gemfile /myapp/Gemfile
ADD Gemfile.lock /myapp/Gemfile.lock
RUN bundle install
ADD . /myapp

4. FROM ruby:2.2.0
Not supported on https://hub.docker.com/_/ruby/
The following packages will be upgraded:
curl dpkg dpkg-dev ghostscript gir1.2-gdkpixbuf-2.0 git git-man krb5-multidev
libcups2 libcupsfilters1 libcupsimage2 libcurl3 libcurl3-gnutls
libcurl4-openssl-dev libdpkg-perl libexpat1 libexpat1-dev libfreetype6
libfreetype6-dev libgdk-pixbuf2.0-0 libgdk-pixbuf2.0-common
libgdk-pixbuf2.0-dev libgnutls-deb0-28 libgs9 libgs9-common libgssapi-krb5-2
libgssrpc4 libicu52 libk5crypto3 libkadm5clnt-mit9 libkadm5srv-mit9 libkdb5-7
libkrb5-3 libkrb5support0 libldap-2.4-2 libmysqlclient-dev libmysqlclient18
libpng12-0 libpng12-dev libpq-dev libpq5 libsasl2-2 libsasl2-modules-db
libsqlite3-0 libsqlite3-dev libssl-dev libssl-doc libssl1.0.0 libsvn1
libtasn1-6 libwmf-dev libwmf0.2-7 libxml2 libxml2-dev linux-libc-dev mercurial
mercurial-common mysql-common openssh-client openssl perl perl-base
perl-modules subversion
64 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
Need to get 47.6 MB of archives.
After this operation, 199 kB of additional disk space will be used.

5. FROM ruby:2.2.0
openssl (1.0.1k-3+deb8u2) jessie-security; urgency=medium
* Fix CVE-2015-3194
* Fix CVE-2015-3195
* Fix CVE-2015-3196
-- Kurt Roeckx <kurt@roeckx.be> Thu, 03 Dec 2015 18:39:46 +0100
openssl (1.0.1k-3+deb8u1) jessie-security; urgency=medium
* Fix CVE-2015-1791
* Fix CVE-2015-1792
* Fix CVE-2015-1789
* Fix CVE-2015-1790
* Fix CVE-2015-1788
* CVE-2015-4000: Have minimum of 768 bit for DH
-- Kurt Roeckx <kurt@roeckx.be> Thu, 11 Jun 2015 20:55:20 +0200
openssl (1.0.1k-3) unstable; urgency=medium
* Drop patch 0003-Free-up-passed-ASN.1-structure-if-reused.patch, it at
least breaks voms, possibly others. (Closes: #781081)
-- Kurt Roeckx <kurt@roeckx.be> Tue, 24 Mar 2015 21:34:00 +0100
openssl (1.0.1k-2) unstable; urgency=high
* Fix CVE-2015-0286
* Fix CVE-2015-0287
* Fix CVE-2015-0289
* Fix CVE-2015-0293 (not affected, SSLv2 disabled)
* Fix CVE-2015-0209
* Fix CVE-2015-0288
* Remove export ciphers from DEFAULT.
* Make DTLS always act as if read_ahead is set. This fixes a regression
introduce by the fix for CVE-2014-3571. (Closes: #775502)
-- Kurt Roeckx <kurt@roeckx.be> Fri, 20 Mar 2015 18:24:15 +0100

6. Even supported images might not have the latest updates
FROM ruby:2.2.0
RUN apt-get update -qq &&
grep security /etc/apt/sources.list > /tmp/security.list &&
apt-get upgrade -y -o Dir::Etc::Sourcelist=/tmp/security.list

7. FROM ruby:2.2.0
RUN apt-get update -qq && apt-get install -y build-essential libpq-dev
RUN mkdir /myapp
WORKDIR /myapp
ADD Gemfile /myapp/Gemfile
ADD Gemfile.lock /myapp/Gemfile.lock
RUN bundle install
ADD . /myapp

8. RUN bundle install
gem 'blah',
git: 'git@github.com:blah/blah.git',
ref: 'adc83b19e793491b1c6ea0fd8b46cd9f32e592fc'

9. don’t commit secrets.

10. gem 'blah',
git: 'https://<token>:x-oauth-basic@github.com/blah/blah.git',
ref: 'adc83b19e793491b1c6ea0fd8b46cd9f32e592fc'

11. ADD ssh-private-key /root/.ssh/

12. RUN bundle install
● share ssh-agent socket with docker build
● bundle install (as developer or CI identity) before build
● vendor gems in git

13. bundle package --all

14. FROM ruby:2.2.0
RUN apt-get update -qq && apt-get install -y build-essential libpq-dev
RUN mkdir /myapp
WORKDIR /myapp
ADD Gemfile /myapp/Gemfile
ADD Gemfile.lock /myapp/Gemfile.lock
RUN bundle install
ADD . /myapp

15. ADD . /myapp
ROOOOOOOT

16. ADD . /myapp
ROOOOOOOT

17. FROM ruby:2.2.0
RUN apt-get update -qq && apt-get install -y build-essential libpq-dev
RUN mkdir /myapp
WORKDIR /myapp
ADD Gemfile /myapp/Gemfile
ADD Gemfile.lock /myapp/Gemfile.lock
RUN bundle install
ADD . /myapp

18. what to run?
myapp_web_1 | [2014-01-17 17:16:29] INFO WEBrick 1.3.1

19. configuration

20. environment > file config
figaro, dotenv
development:
adapter: mysql2
database: foo
username: <%= Config.DATABASE_USERNAME %>
password: <%= Config.DATABASE_PASSWORD %>
host: <%= Config.DATABASE_HOST %>
test:
adapter: mysql2
database: foo_test
username: <%= Config.DATABASE_USERNAME %>
password: <%= Config.DATABASE_PASSWORD %>
host: <%= Config.DATABASE_HOST %>

21. DNS based values
<region>.do.co

22. config everything
Redis.new(:host => "10.0.1.1")
Redis.new(:url => "redis://:p4ssw0rd@10.0.1.1:6380/15")

23. www.digitalocean.com/company/careers
@tam7t
Thanks!