Top
Best
New

Posted by jxmorris12 1 day ago

The Twelve-Factor App (2025)(12factor.net)
245 points | 131 commentspage 2
mermadicsolutio 7 hours ago|
I'm debating the tradeoff for secret management in my app as well. Storing it is easy you just need encryption and it's mostly good. But delivering it is tricky. Delivery via env is simple for sure but can get leaked. The other route would be a job scoped signature, but this doesnt stop the job from printing the secret out, it only shrinks the blast radius.

But if you delete the secret after the job is done or deployment is up, it's pretty much the same result

onionisafruit 8 hours ago||
I'm not sure where the (2025) in the title comes from, but this has been around much longer than that.
blurrybird 7 hours ago||
+1. I saw the 2025 suffix and fact that it was on the original domain and hoped they released a v2 to carry us through the world of Platform Engineering, Observability 2.0, Kubernetes vs Serverless, etc.
tflinton 4 hours ago|||
Heroku updated it in 2025.
NtG_UK 6 hours ago||
2011 according to the earliest post on HN
echrisinger 11 hours ago||
> X. Dev/prod parity > Keep development, staging, and production as similar as possible

Gets interesting at the seams of software & data environments. If my preprod stack operates independently of my prod stack (due to different internal users), but preprod data stack is best tested on prod data, the seams of these two things imply there should be a separate data stack for both preprod data versus preprod-internal.

Generally pro 12-FA, but it's very service dev oriented.

nkmnz 9 hours ago|
I know an e-commerce company where the staging environment was completely hijacked by product managers to "stage" their data. They've even convinced management to ask IT to build a tool for migrating data from staging to production. All of this just to avoid building a proper release flow for (product-)data.
michchinn 15 hours ago||
https://news.ycombinator.com/item?id=37862016

> Related:

> Ask HN: Is 12factor.net Still Relevant? - https://news.ycombinator.com/item?id=36283702 - June 2023 (6 comments)

> 12 Factor App Revisited - https://news.ycombinator.com/item?id=33164407 - Oct 2022 (7 comments)

> Twelve-factor app anno 2022 - https://news.ycombinator.com/item?id=31225921 - May 2022 (35 comments)

> The Twelve-Factor App (2011) - https://news.ycombinator.com/item?id=31198956 - April 2022 (102 comments)

> Twelve-factor app development on Google Cloud - https://news.ycombinator.com/item?id=21415488 - Nov 2019 (63 comments)

> The Twelve-Factor App - https://news.ycombinator.com/item?id=19947507 - May 2019 (3 comments)

> 12 Factor CLI Apps - https://news.ycombinator.com/item?id=18172689 - Oct 2018 (247 comments)

> 12 factor app configuration vs. leaking environment variables (2014) - https://news.ycombinator.com/item?id=15869436 - Dec 2017 (2 comments)

> Ask HN: Alternative to Heroku that doesn't enforce 12-factor - https://news.ycombinator.com/item?id=10628961 - Nov 2015 (1 comment)

> The Twelve-Factor App - https://news.ycombinator.com/item?id=10288216 - Sept 2015 (3 comments)

> The Twelve-Factor App - https://news.ycombinator.com/item?id=9492120 - May 2015 (2 comments)

> Twelve-Factor Applications with Consul - https://news.ycombinator.com/item?id=7780249 - May 2014 (2 comments)

> The Twelve-Factor App - https://news.ycombinator.com/item?id=7547687 - April 2014 (1 comment)

> Building Twelve Factor Apps on Heroku - https://news.ycombinator.com/item?id=6219444 - Aug 2013 (1 comment)

> 12 Factor model for architecting SaaS applications - https://news.ycombinator.com/item?id=6060381 - July 2013 (1 comment)

> The Twelve-Factor App - https://news.ycombinator.com/item?id=5979452 - July 2013 (1 comment)

> 12factor: Methodology for Building Software-as-a-Service Apps - https://news.ycombinator.com/item?id=4027026 - May 2012 (1 comment)

> Twelve Factors of Web Application Development - https://news.ycombinator.com/item?id=3267187 - Nov 2011 (37 comments)

_superposition_ 14 hours ago||
Still relevant.
luciandan 9 hours ago||
I love it how this is still at thing. Good principles never die, just like good music I guess.
lxe 9 hours ago||
I know that all of this is super relevant, but it's extremely aspirational, and I can pick apart pretty much every one of these factors on how it doesn't fully hold up when it comes to the reality of production applications.
Silasdev 9 hours ago||
Of course you can, but it's still a really great collection of good practices that lead you to a better place than if you didn't to do any of it.
tflinton 4 hours ago|||
I know large Fortune 500 companies with 10,000 apps that follow it pretty religiously.
duderific 6 hours ago||
Principles are by definition aspirational. The idea, I'd say, is to always have them in mind and get as close to them as possible.
Tomte 14 hours ago||
Every time it gets posted I read through the list and think "export services via port binding… of course a web server binds to a port, of course it‘s decoupled that way, what else would you do" and "treat backing services as attached resources… huh, is that really only about not linking in a database, but connecting using a JDBC string, for example?"

So let me ask for once: what am I missing? Why is that interesting and not trite?

ipsi 13 hours ago||
If you go far enough back in time (this dates back to at least 2011), it's arguing against things like:

For port binding, for example, it used to be that you'd deploy your app to the web application container, rather than bundling them together. e.g., deploying your WAR file to Tomcat, rather than building a self-executing JAR which included Tomcat. The wording is a bit odd, but I think they were trying to make the point very generic, and not specifically about the Enterprise Java world.

For the backing resources, it's a combination of point 3, config often living inside the codebase, applications just shelling out to /usr/sbin/sendmail or what have you, and applications living on the same host as the DB, such that bringing up a new application necessarily required bringing up a new DB as well. Which also made it hard it to scale horizontally.

The whole "12 Factor" thing was partly because Heroku had specific solutions for all of these, so going down this road made it much easier to then sell Heroku, and partly because they really were frustrating. I'd say that the port binding one is more targeted at, say, WebSphere, and all that came along with it, such as sharing a single heap across multiple apps, needing to talk to the WebSphere admins to change configuration, needing to use a "lite" version of WebSphere to test locally, if that was even possible, and so on.

They sound super-obvious these days, but at the time, for a lot of us, they were really nice to see.

dec0dedab0de 13 hours ago|||
I think backing services as attached resources was opposed to the practice of having your DB, and cache, and whatnot managed and maintained by a completely separate team and not really treated as part of the application. Even the schema changes.

The port binding was really a response to tomcat or modphp being modules in the webserver, as opposed to hosting their own web service internally. This was before nginx took off, and proxying to internal application ports was common.

edit:

I was wrong about the backing services, it seems it is really about treating them as configurations and being able to swap them out without making code changes.

https://12factor.net/backing-services

jaggederest 13 hours ago|||
> Why is that interesting and not trite?

The same reason many older films seem cliche - because they were the first to do it, and it's accepted standard now. Heroku very much shaped how we think of "cloud applications", autoscaling, and containerization.

stephbook 12 hours ago|||
Doctors didn't wash their hands between inspecting corpses and doing surgery.

Drivers protested against seat belts that would save their own lives.

Times change and hindsight is 20/20. Let's just say 10 years ago I worked at a company that broke all 12 factors.

jaggederest 3 hours ago||
I appreciate you giving those examples, I was searching for something like that, seat belts in particular were controversial to a degree that is absolutely difficult to imagine these days, I think, even having lived through it as a kid.
tflinton 4 hours ago|||
In older architectures you would expose services as libraries and everything ran in one UBER process… eg JBoss and ASP.. it also covered off on web server processing like cold fusion and php.
anon7000 13 hours ago||
I think you gotta look back to how web servers worked before containers.
bad_username 12 hours ago|
> X. Dev/prod parity Keep development, staging, and production as similar as possible

Notably, there is no requirement or recommendation that the dev environment be a single, shared environment. Development processes where this environment is single is shared is as terrible as it is ubiqitous.

More comments...