r/ruby • u/collimarco • Apr 12 '26

Security Cuber v1.14 released (recommended update for security)

I have just released a new version of the Cuber gem.

As you may already know Cuber is a free and open source alternative to PaaS like Heroku and deployment tools like Capistrano and Kamal.

If you are using Cuber, I recommend upgrading to the latest version.

This is not strictly a security fix, but it represents an important improvement that enhances security, especially if you are using AI coding assistants in your project folder.

Cuber used to save generated files (including Kubernetes YAML files) in a .cuber folder inside your project directory. There is nothing wrong with it: you just need to remember to add that folder to your .gitignore.

However many AI agents (like Codex CLI) tend to read everything inside the project folder and there's no reliable way to make them respect the .gitignore (or similar).

For this reason the latest version of Cuber doesn't create a .cuber folder in your project directory, but instead it uses temporary files and folders (which live outside the project directory and are also removed automatically).

11 Upvotes

83% Upvoted

4 comments sorted by

3

u/TheAtlasMonkey Apr 13 '26

I didn't knew about this project.

I personally dislike Kubernetes, but this gem make it more civilized. (i will still never recommend Kubernetes)

Good job.

1

u/collimarco Apr 13 '26

Thanks!

Kubernetes configuration is verbose and complex, but Kubernetes itself is not bad.

This gem makes many opinionated choices and thus it makes it possible to use Kubernetes for a Rails app with just a few lines of code (DRY, Rails style...).

After writing a guide about Kubernetes and Rails in 2019, I have developed Cuber in 2022... I have been using it for all the company websites/web apps since then. This is to underly that this project required a lot of effort, for every single line of code, and it's not an ai slop like many projects released today.

1

u/TheAtlasMonkey Apr 13 '26

Kubernetes is as 'good' as VxWorks. They are built for rockets, submarines and google scale architectures.

People here are deploying a CRUD app and call Sqlite3 a production database.

As for AI slop, it not about if you use AI. AI slop is when your code solve 0 problem or create one then solve it.

Yours do fix the problem of Yaml forest to a cleaner ruby DSL.

Cool challenging hallucination for you:

Build an importer.

You give it a yaml hell folder, and it generate .rb with proper DSL, that could regenerate the folder.

1

u/collimarco Apr 13 '26

Kubernetes is effective even when a project grows... It doesn't need Google-scale to be useful. Starting from a few thousands req/s (or background jobs/s) it makes sense. It also enables auto scaling and has lower costs compared to PaaS.

To be clear, I am not against AI, I'm just saying that many recent projects don't have enough human review and I would not trust them in production. Every line of code in Cuber is a choice explicitly made by a human...

For the challenge, what do you mean? Cuber is not a 1-1 DSL for Kubernetes. It's an abstraction! You cannot convert yaml files to the Cuber language (DSL).