Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    text
    copied!<h2>Answer to your question</h2> <p>Bundler's <a href="http://gembundler.com/v1.3/bundle_package.html" rel="noreferrer"><code>bundle package --all</code></a> command will lock and cache all of your gem files into <code>./vendor/cache</code>, and you can run <code>bundle install --local</code> so it won't check rubygems.org in the future.</p> <h2>Comments on your question</h2> <p>This question made me cringe because, while I understand the interest in having a "base image" that you know works, it sounds like a few problems will spill over to other projects.</p> <ol> <li>Overburdened applications <ul> <li>Does each project really need all the same dependencies?</li> <li>If not, then you are bloating each install with unneeded dependencies.</li> </ul></li> <li>Brittle dependencies <ul> <li>You mention that your dependencies are very sensitive to each other, which sets off alarms.</li> <li>I don't fully understand what you mean by that, but it sounds like you should consider finding dependencies with more stable interfaces.</li> <li>Check out ruby-toolbox.com and keep an eye on the "Released" date.</li> </ul></li> <li>Outdated dependencies <ul> <li>Locking down versions means your new applications will not benefit from updates by the maintainers.</li> <li>(example) if you locked your rails dependency to 3.2.8 and continue to use it, you open yourself (and customers) to several major security holes.</li> <li>(possible fix) Look at <a href="http://docs.rubygems.org/read/chapter/16" rel="noreferrer">pessimistic version constraints</a> to allow your applications to receive non-breaking fixes.</li> </ul></li> </ol> <p>Best of luck.</p>
 

Querying!

 
Guidance

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload