---
title: "Securing Dependencies for Rails 5.2 Active Storage"
description: "Supporting Rails 5.2 Active Storage on Heroku required handling media files for PDF and video previews while addressing FFmpeg’s security and packaging constraints. Ubuntu Trusty’s lack of FFmpeg support, Xenial’s community-maintained package and missing vulnerability backports, and concerns about Libav led the team to build its own binary. Using a fork of sffmpeg and modified CMake configuration, the team created a static FFmpeg build that removed non-free software and unused components such as RTMP and xvid, reducing dependencies and attack surface. Docker-based CircleCI automation compiles the binary, packages it as a Debian archive, uploads it to AWS S3, and lets the buildpack install it without root access. The resulting package is about 30MB instead of roughly 200MB and can be updated in around 20 minutes after upstream security releases."
---

# Securing Dependencies for Rails 5.2 Active Storage

[Heroku](https://yomu.fyi/company/heroku) · Craig Ingram · May 22, 2018

**Type:** Problem & solution

## Summary

Supporting Rails 5.2 Active Storage on Heroku required handling media files for PDF and video previews while addressing FFmpeg’s security and packaging constraints. Ubuntu Trusty’s lack of FFmpeg support, Xenial’s community-maintained package and missing vulnerability backports, and concerns about Libav led the team to build its own binary. Using a fork of sffmpeg and modified CMake configuration, the team created a static FFmpeg build that removed non-free software and unused components such as RTMP and xvid, reducing dependencies and attack surface. Docker-based CircleCI automation compiles the binary, packages it as a Debian archive, uploads it to AWS S3, and lets the buildpack install it without root access. The resulting package is about 30MB instead of roughly 200MB and can be updated in around 20 minutes after upstream security releases.

## Context

Heroku needed to support Rails 5.2 Active Storage previews for PDFs and videos. FFmpeg presented security and distribution challenges: Ubuntu Trusty did not support it, Xenial’s package lacked backports for several vulnerabilities, and Libav was described as having numerous unresolved bugs.

## Approach / What changed

The team forked sffmpeg, modified its CMake configuration to remove non-free software and unused libraries, and built a static FFmpeg binary packaged as a Debian archive. Docker-based CircleCI automation compiles and uploads the package to AWS S3, while the Active Storage Preview buildpack extracts it into application dynos without root access.

## Takeaways

- The reduced static build is about 30MB, compared with roughly 200MB for FFmpeg and its default dependencies.
- Removing unused components such as RTMP stream support and xvid reduces dependencies that would require security monitoring and could introduce vulnerabilities.
- The automated CI build and upload process takes around 20 minutes, enabling rapid distribution of patches after upstream security releases.

**Tags:** [CI/CD](https://yomu.fyi/topic/ci-cd), [FFmpeg](https://yomu.fyi/topic/ffmpeg), [Ruby on Rails](https://yomu.fyi/topic/ruby-on-rails)

- Source: [Heroku](https://www.heroku.com/blog/security-rails-active-storage)
- Source URL: https://www.heroku.com/blog/security-rails-active-storage
- Ingested by Yomu: 2026-09-09T14:26:30.901Z

[Read original post](https://www.heroku.com/blog/security-rails-active-storage)