TLDR Tech / Launches
Hot Cell v1.0: Securing Active Storage in the age of AI
37signals has released Hot Cell v1.0, a suite of gems designed to isolate Active Storage attachment processing from Rails applications into an unprivileged sidecar container. The system enforces strict resource limits, relies on UNIX sockets and file descriptor passing instead of network access, and is already running in production across Basecamp, HEY, and Fizzy. The author explains that the tool was created to mitigate severe security risks and blast radiuses associated with vulnerabilities in image processing libraries being actively targeted by AI.
Read the full story