Skip to content
Ruby on Rails Application Stack product logo
  • AWS· soonComing soon on Amazon Web Services
  • Azure· nextMicrosoft Azure is next on the roadmap
  • GCP· nextGoogle Cloud is next on the roadmap
Coming soon

Ruby on Rails Application Stack

Ruby on Rails 8.1.3.1 on Ruby 3.4.10 with Puma, MySQL 8.0, phpMyAdmin and Webmin. A starter app runs in production mode as an unprivileged user under systemd with Hotwire included - the Rails way to build the front end - and SECRET_KEY_BASE and the database password are regenerated for your instance at first boot.

Version
Rails 8.1.3.1 / Ruby 3.4.10
Operating system
Ubuntu 24.04 LTS
Architecture
x86_64
Support
Community

What's installed

Every package and version on the image. Nothing else is installed.

  • Ruby 3.4.10
  • Rails 8.1.3.1
  • Puma 8.0.2
  • MySQL 8.0.46
  • Apache 2.4
  • PHP 8.3.6
  • phpMyAdmin 5.2.3
  • Webmin 2.660

Licensing — Open source (MIT), no licence key required

Deploy anywhere

Ruby on Rails Application Stack on AWS.

Microsoft Azure and Google Cloud are next on the roadmap. One clean-room build, one first-boot credential model, one patch cadence — identical on every cloud you run. Every identifier below is the real one; copy it and launch.

  1. AWS

    Amazon Web Services

    AMI · Rails 8.1.3.1 / Ruby 3.4.10

    Coming soon

    AWS AMI ID

    ami-0e0896afc0d5e929c
    Released
    September 13, 2026
    Root volume
    gp3 · 20 GiB

    Instance types

    • t3a.medium
    • t3.medium
    • t3a.large
    • m6a.large

    Regions

    • us-east-1
    AWS launch steps

Getting started

From launch to signed in, step by step.

  1. Launch in us-east-1 with TCP 22, 80, 3000 and 8000 open; wait for the health checks.

  2. Open http://<instance-public-ip>:3000 for the Rails app. phpMyAdmin: http://<instance-public-ip>/phpmyadmin (username root). Webmin: port 8000 (username admin or root). The password for both is your EC2 Instance ID (for example i-0123456789abcdef0).

  3. Deploy your app to /var/www/railsapp, keep config/database.yml reading ENV["RAILSAPP_DATABASE_PASSWORD"], then sudo systemctl restart railsapp - or point the unit's WorkingDirectory at your own path.

  4. Config lives in /etc/railsapp/env. rails-info prints URLs, versions and service status; sudo journalctl -u railsapp -f follows logs.

  5. SSH as ubuntu with your key pair. Change passwords with sudo bash /home/ubuntu/iscripts/pass_mysql.sh, pass_webmin.sh or pass_all.sh.

Security posture

What this image does and does not ship with, one fact per line.

  • Clean-room build on Canonical's official Ubuntu 24.04 LTS image: every component comes from its own official repository or release, nothing is copied from any third-party image, and the finished image was scanned for third-party vendor strings before capture.

  • No usable credential ships in the image; passwords are set on your instance at first boot from EC2 instance metadata (IMDSv2) and the scripts that set them delete themselves afterwards.

  • SSH is key-only, root login over SSH is refused, and build-time SSH keys, shell history and logs were removed before imaging.

  • First boot regenerates SECRET_KEY_BASE and the application database password for this instance, together with the phpMyAdmin cookie key - without that, a session forged on any instance would be accepted on all of them - and sets the MySQL root and Webmin passwords from the Instance ID.

  • MySQL automation uses a socket-authenticated account bound to OS root, so no stored password exists to be stripped and only a root process can use it.

  • The Rails app runs as the unprivileged rails user with its environment file mode 0640.

  • Rails 8's forced SSL is disabled in production.rb so the app answers at a bare IP; re-enable it once you have a certificate.

  • The bundled password tools enforce at least 10 characters with upper- and lower-case letters, a number and a symbol, and verify the new credential with a real sign-in before reporting success.

  • The image is HTTP-only by design so it works at a bare IP with no certificate warnings: terminate TLS at a load balancer or add a certificate before exposing it publicly, and restrict port 22 and any admin ports to trusted IP ranges in your security group.