A Ruby (and especially Rails) project’s .gitignore covers bundler installs, log files, temp directories, and Rails-specific storage and credentials. The list above is a known-good modern set; this page explains the entries.

Bundler

.bundle/
vendor/bundle/

.bundle/ is bundler’s per-project config (paths, deployment mode). vendor/bundle/ is where bundle install --path vendor/bundle puts gems — gigabytes of native code, regenerable.

If your project uses bundle install without --path (the modern default), gems go to a system-wide directory and there’s no vendor/bundle/. The ignore is harmless either way.

# Don't ignore these:
# Gemfile
# Gemfile.lock

Gemfile.lock is the lockfile. Always commit for applications (including Rails apps); contentious for libraries published as gems (the Bundler maintainers’ guidance is to commit it for apps, not for gems).

Logs

log/
log/*
*.log

Rails writes logs to log/development.log, log/test.log, log/production.log. They grow without bound. Per-environment, per-developer, never useful to commit.

For non-Rails Ruby projects, *.log is the broader catch.

Temp directories

tmp/
tmp/*
!tmp/.keep

Rails uses tmp/ for cache, sessions, sockets. The !tmp/.keep negation re-includes a placeholder file so Git tracks the empty tmp/ directory.

For non-Rails Ruby, tmp/ is a less universal convention.

Coverage

coverage/
.rspec-coverage/
.simplecov

SimpleCov, the standard Ruby coverage gem, writes to coverage/. Regenerable; not useful to commit.

Test artifacts

.byebug_history
.rspec_status
spec/examples.txt

byebug (the debugger) writes a per-user history file. .rspec_status and spec/examples.txt cache RSpec state.

Rails-specific

# Database files (development SQLite)
*.sqlite3
*.sqlite3-journal
*.sqlite3-*

# Storage (Active Storage local disk service)
/storage/*
!/storage/.keep
storage/
public/uploads/

# Webpacker / esbuild / importmap
public/assets/
public/packs/
public/packs-test/
node_modules/

*.sqlite3 is the Rails development database. Don’t commit it — every developer should have their own.

storage/ is Active Storage’s local disk service (uploaded files in dev). User-uploaded data; never useful to commit.

public/assets/, public/packs/ are compiled assets — output of asset pipeline / Webpacker / Sprockets. Regenerable.

Master key and credentials

config/master.key
config/credentials/*.key

Critical. Rails 5.2+ encrypts secrets with a master key. The encrypted credentials file (config/credentials.yml.enc) is committed; the master key (config/master.key) is not. Without the key, the encrypted file is unreadable.

Distribute the master key out-of-band (password manager, secure share, environment variable on production). Committing it defeats the encryption.

Environment files

.env
.env.local
.env.*.local

If using dotenv-rails, the .env file holds development-time environment variables. Often includes secrets. Don’t commit.

OS and editor

.DS_Store
Thumbs.db
.idea/
.vscode/

Standard.

YARD documentation

.yardoc/
doc/
rdoc/

YARD and RDoc generate documentation in these directories. Regenerable from source.

Bundler binstubs

# Don't ignore these:
# bin/bundle
# bin/rails
# bin/rake

Rails generates bin/ scripts for common commands. Commit them — they pin specific versions of common Ruby gems for the project.

The contentious case: bin/spring and similar dev-only stubs. Some teams commit them (shared development experience); some don’t (per-developer).

Common pitfalls

Committing config/master.key. Defeats the credentials encryption. The single most common Rails security mistake.
Committing *.sqlite3. Each developer’s database is different. Committing makes the next person’s db:setup confused.
Committing public/assets/ after compiling for production. Production builds belong in deployment artifacts, not the repo.
Ignoring config/credentials.yml.enc. Don’t — the encrypted file is meant to be committed. Only the master key isn’t.
Forgetting tmp/ and log/ placeholders. A repo without tmp/.keep has no tmp/ directory at all in fresh checkouts; some Rails commands assume it exists.
Ignoring Gemfile.lock. Same as Node’s package-lock.json — breaks reproducibility for application deployments.

For other stacks, see Python, Node.js, Java, Go, Rust, .NET, or the general .gitignore generator.

Ruby / Rails .gitignore