ruby

Each tag is a multi-arch index (amd64 + arm64) pinned by digest. Tagged by version, never :latest.

Use it as a base image

Reference it in the FROM line of your Dockerfile. Nonroot, read-only root filesystem, built for amd64 and arm64.

FROM ghcr.io/quenchworks/images/ruby:3.4.10

Or pull it directly

docker pull ghcr.io/quenchworks/images/ruby:3.4.10

Version line

3.4.10

Latest line

3.4.10

Architectures

amd64, arm64

Runs as

nonroot (uid 1001)

Root filesystem

read-only

License

Ruby

Verify the supply chain

This image is cosign-signed and carries an SPDX SBOM and a SLSA build-provenance attestation on the same digest. Check all three before you build on it:

# 1. signature — built and signed by QuenchWorks CI
cosign verify ghcr.io/quenchworks/images/ruby:3.4.10 \
  --certificate-identity-regexp 'https://github.com/quenchworks/.+' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

# 2. SLSA build provenance — which workflow built it, from what
cosign verify-attestation --type https://slsa.dev/provenance/v1 ghcr.io/quenchworks/images/ruby:3.4.10 \
  --certificate-identity-regexp 'https://github.com/quenchworks/.+' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

# 3. SPDX SBOM — the package inventory
cosign verify-attestation --type https://spdx.dev/Document/v2.3 ghcr.io/quenchworks/images/ruby:3.4.10 \
  --certificate-identity-regexp 'https://github.com/quenchworks/.+' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

See the SBOM & provenance guide for reading the SBOM and using these checks in CI.

Best-practice Dockerfile for 3.4.10

Install gems with Bundler in deployment mode in the build stage, then copy the vendored bundle and app onto a clean ruby base. Native gem build tooling stays behind.

1
# Build stage: install gems in deployment mode (build deps included).
2
FROM ghcr.io/quenchworks/images/ruby:3.4.10 AS build
3
USER root
4
WORKDIR /app
5
ENV BUNDLE_PATH=/app/vendor/bundle \
6
    BUNDLE_DEPLOYMENT=true \
7
    BUNDLE_WITHOUT=development:test
8

9
COPY Gemfile Gemfile.lock ./
10
RUN ["bundle", "install"]
11
COPY . .
12

13
# Runtime stage: copy the vendored bundle + app onto a clean ruby base.
14
FROM ghcr.io/quenchworks/images/ruby:3.4.10 AS runtime
15
WORKDIR /app
16
ENV BUNDLE_PATH=/app/vendor/bundle \
17
    BUNDLE_DEPLOYMENT=true \
18
    BUNDLE_WITHOUT=development:test \
19
    GEM_HOME=/tmp/gem
20
COPY --from=build /app /app
21
USER 1001
22
EXPOSE 3000
23
CMD ["bundle", "exec", "ruby", "app.rb"]

This Dockerfile is pinned to the 3.4.10 line. For the line-by-line walkthrough and ecosystem variants (npm/Yarn, pip/uv/Poetry, Maven/Gradle), see the Build hardened imagesguide.