First, I create a docker folder and I add the following files in it:

• Dockerfile
• entrypoint.sh

Then, I add a docker-compose.yml in the root folder of the project. Simply run:

docker compose run --rm cli <your_bundle_exec_command>

⚠️ The image will be built only at the first execution and subsequent calls won’t automatically rebuild the initial image. If your making changes along the way you need to add the --build option:

docker compose run --build --rm cli <your_bundle_exec_command>

Dockerfile

ARG RUBY_VERSION=3
FROM ruby:${RUBY_VERSION}-alpine

ENV BUNDLE_PATH /usr/local/bundle/gems
ENV LIB_PATH /var/gem
# --enable-frozen-string-literal maybe not be suitable for all projects 
ENV RUBYOPT --enable-frozen-string-literal --yjit
# taken from dockerfile-rails https://github.com/fly-apps/dockerfile-rails/blob/f34fab26ae3b77a14c15b4bafb0fb91f911b8d8a/lib/generators/dockerfile_generator.rb#L981-L983
ENV LD_PRELOAD libjemalloc.so.2
ENV MALLOC_CONF dirty_decay_ms:1000,narenas:2,background_thread:true

# these packages should cover the basics but you might need more
RUN apk add --update --no-cache make g++ gcc git libc-dev gcompat jemalloc && \
    gem update --system && gem install bundler

WORKDIR $LIB_PATH

COPY /docker/entrypoint.sh /usr/local/bin/docker-entrypoint.sh
RUN chmod +x /usr/local/bin/docker-entrypoint.sh

ENTRYPOINT ["docker-entrypoint.sh"]

entrypoint.sh

#!/bin/sh

set -e

# Useful information
echo -e "$(ruby --version)\nrubygems $(gem --version)\n$(bundle version)"
# Can run different gemfiles located in `gemfiles` folder
if [ -z "${GEMFILE}" ]
then
  echo "Running default Gemfile"
else
  export BUNDLE_GEMFILE="./gemfiles/${GEMFILE}.gemfile"
  echo "Running gemfile: ${GEMFILE}"
fi

# Keep gems in the latest possible state
(bundle check || bundle install) && bundle update && exec bundle exec ${@}

docker-compose.yml

volumes:
  gems:

x-base: &base
  build:
    context: .
    dockerfile: docker/Dockerfile
    args:
      # you can set a specific version
      - RUBY_VERSION=${RUBY_VERSION:-3}
  stdin_open: true
  tty: true
  volumes:
    - .:/var/gem
    - gems:/usr/local/bundle
# if you have multiple gemfiles (see entrypoint.sh), 
# simply uncomment the following lines and change <gemfile_name>
# environment:
#  GEMFILE: <gemfile_name>

services:
  cli:
    <<: *base

If you need to run a server, you can add another service that will run a command and expose a port. Here’s a example to with jekyll with live reload

  server:
    <<: *base
    ports:
      - 4000:4000
    # need to change the host since we're running in Docker
    command: [ 'jekyll', 'serve', '--host', '0.0.0.0', '-l' ]

To start the service: docker compose run --rm --service-ports server

Let’s talk about strategies.

Depending of your current situation (multiple teams , multiple endpoints 😅, etc…), you need a scalable and sustainable solution over time. I’m talking about some kind of tool that will give some awareness first and gives hard stops (exceptions) through progression. Being smooth at the beginning and tighten things up at some point.

Leveraging config.active_support.deprecation feels like the best choice to me since you can easily change the behavior through environments. Warnings is also a good choice depending if you’re handling them or not. I found a great article about that.

Instrumentation is your friend

A while ago, I came up with a neat solution using instrumentation and a middleware. Basically, it wraps all non GET/HEAD request with a subscription to sql.active_record. The subscription’s callback looks at the payload for writable sql statements. It will then apply the chosen strategy depending of your choice if any writable statements were found.

This middleware does not log SQL statements but a debug parameter could be added to show a complete list (might be useful) Lastly,

# frozen_string_literal: true
# lib/middlewares/read_only_middleware.rb

module Middlewares
  class ReadOnlyMiddleware
    WRITABLE_SQL_STATEMENTS = %w[INSERT UPDATE DELETE UPSERT MERGE].freeze

    thread_mattr_accessor :found_sql_writable_statement

    attr_reader :app, :reporting_strategy

    def initialize(app, strategy: nil)
      @app = app
      @reporting_strategy = resolve_strategy(strategy)
    end

    def call(env)
      request = Rack::Request.new(env)
      return _call(env) unless request.get? || request.head?

      self.found_sql_writable_statement = false
      response = nil
      ActiveSupport::Notifications.subscribed(method(:notification_callback), 'sql.active_record') do
        response = _call(env)
      end
      report(request)
      response
    end

    private

    def _call(env)
      @app.call(env)
    end

    private

    def notification_callback(*args)
      event = ActiveSupport::Notifications::Event.new(*args)
      return if found_sql_writable_statement || !event.payload[:sql].start_with?(*WRITABLE_SQL_STATEMENTS)

      self.found_sql_writable_statement = true
    end

    def report(request)
      return unless found_sql_writable_statement

      reporting_strategy.warn("The following endpoint is not readonly: #{endpoint_info(request)}")
    end

    def endpoint_info(request)
      path_params = request.env[ActionDispatch::Http::Parameters::PARAMETERS_KEY]
      "#{path_params[:controller]}##{path_params[:action]}"
    end

    def resolve_strategy(strategy)
      case strategy
      when :deprecation
        ActiveSupport::Deprecation
      else
        Rails.logger
      end
    end
  end
end

In your application.rb

require 'middlewares/read_only_middleware'
config.middleware.use Middlewares::ReadOnlyMiddleware, strategy: :deprecation

ActiveSupport::Deprecation and Rails.logger came naturally to my mind since you might already have a strategy(:notify, :raise, etc…) in your app based on your environment.