The Twelve-Factor App (2025)

245 points - last Thursday at 10:41 PM

Comments

nebezb yesterday at 3:47 PM

Still incredibly relevant. Even if you don’t apply it, there is so much to learn by reading this in 15 minutes.

The only grievance I have with this is Chapter 3: Config [1] “Store config in the environment”, “Credentials to external services such as Amazon S3 or Twitter”

Besides being bad advice, this had the second-order effect of leading devs to believe they could put all their local env secrets in ~/.bashrc files.

Stop doing this. Do the other 11.5 factors.

[1]: https://12factor.net/config

chanux today at 4:07 AM

Very good discussion on III. Config or the use of environment variables for config.

For the sake of discussion I'd share an argument against X. Dev/Prod parity

https://www.sc.com/engineering/blogs/Technology/development-...

I do not fully agree with the author and I think the author is reaching a bit hard because in my reading Twelve-Factor App X does not argue for complete parity. My reading is that whatever the app is interfacing should be kept as similar as possible.

browningstreet yesterday at 2:35 PM

I really thought this would be a 12 layer MFA demo showing the absurdity of our current painful & unsustainable MFA trends.

dec0dedab0de yesterday at 2:56 PM

Heroku seemed like it was going to be the future back then. Every time I find myself struggling to understand some nonsense in Azure I dream of the simpler future we lost.

sandeepkd yesterday at 4:24 PM

Its interesting how this felt so natural and right way to do software. I remember people referencing it as the north star. And then gradually people came close to it but moved past it. Personally I feel that these concepts require to have generalist mindset aka application architect. What we have as of today are lot of product engineers within teams, product managers and management. The product engineers do not always have enough leverage or incentives to push for these kind of concepts.

And still at the same time these concepts feel like so much carved in stone that one way or another everyone is going to keep discovering them again.

RKearney yesterday at 10:49 PM

Title should read (2011)

https://news.ycombinator.com/from?site=12factor.net

theozero yesterday at 4:20 PM

.env as we know is full of problems... BUT! check out varlock (https://varlock.dev) - it's free and open source, and we have really modernized and adapted the familiar syntax (a small DSL on top) to make it much better.

Has built-in validation, type-safety, composition via functions, loading with plugins, leak prevention, and much more.

subarctic today at 3:17 AM

How is this only from 2025? I thought this was a thing back in 2015

imglorp yesterday at 5:52 PM

Good best practices, mostly, but I feel the 12FA model totally punted on state by defining it out of scope: "state is over there in that external service, three-monkeys-emoji".

Yeah but sometimes state is the entire point and you need to manage it yourself, and then some of your processes must be 9 or 10 factor as a result.

_superposition_ yesterday at 3:28 PM

I can't believe how old this is and I feel like most devs still haven't internalized this which is a shame.

mermadicsolutio yesterday at 9:44 PM

I'm debating the tradeoff for secret management in my app as well. Storing it is easy you just need encryption and it's mostly good. But delivering it is tricky. Delivery via env is simple for sure but can get leaked. The other route would be a job scoped signature, but this doesnt stop the job from printing the secret out, it only shrinks the blast radius.

But if you delete the secret after the job is done or deployment is up, it's pretty much the same result

onionisafruit yesterday at 9:42 PM

I'm not sure where the (2025) in the title comes from, but this has been around much longer than that.

echrisinger yesterday at 6:38 PM

> X. Dev/prod parity > Keep development, staging, and production as similar as possible

Gets interesting at the seams of software & data environments. If my preprod stack operates independently of my prod stack (due to different internal users), but preprod data stack is best tested on prod data, the seams of these two things imply there should be a separate data stack for both preprod data versus preprod-internal.

Generally pro 12-FA, but it's very service dev oriented.

michchinn yesterday at 2:36 PM

https://news.ycombinator.com/item?id=37862016

> Related:

> Ask HN: Is 12factor.net Still Relevant? - https://news.ycombinator.com/item?id=36283702 - June 2023 (6 comments)

> 12 Factor App Revisited - https://news.ycombinator.com/item?id=33164407 - Oct 2022 (7 comments)

> Twelve-factor app anno 2022 - https://news.ycombinator.com/item?id=31225921 - May 2022 (35 comments)

> The Twelve-Factor App (2011) - https://news.ycombinator.com/item?id=31198956 - April 2022 (102 comments)

> Twelve-factor app development on Google Cloud - https://news.ycombinator.com/item?id=21415488 - Nov 2019 (63 comments)

> The Twelve-Factor App - https://news.ycombinator.com/item?id=19947507 - May 2019 (3 comments)

> 12 Factor CLI Apps - https://news.ycombinator.com/item?id=18172689 - Oct 2018 (247 comments)

> 12 factor app configuration vs. leaking environment variables (2014) - https://news.ycombinator.com/item?id=15869436 - Dec 2017 (2 comments)

> Ask HN: Alternative to Heroku that doesn't enforce 12-factor - https://news.ycombinator.com/item?id=10628961 - Nov 2015 (1 comment)

> The Twelve-Factor App - https://news.ycombinator.com/item?id=10288216 - Sept 2015 (3 comments)

> The Twelve-Factor App - https://news.ycombinator.com/item?id=9492120 - May 2015 (2 comments)

> Twelve-Factor Applications with Consul - https://news.ycombinator.com/item?id=7780249 - May 2014 (2 comments)

> The Twelve-Factor App - https://news.ycombinator.com/item?id=7547687 - April 2014 (1 comment)

> Building Twelve Factor Apps on Heroku - https://news.ycombinator.com/item?id=6219444 - Aug 2013 (1 comment)

> 12 Factor model for architecting SaaS applications - https://news.ycombinator.com/item?id=6060381 - July 2013 (1 comment)

> The Twelve-Factor App - https://news.ycombinator.com/item?id=5979452 - July 2013 (1 comment)

> 12factor: Methodology for Building Software-as-a-Service Apps - https://news.ycombinator.com/item?id=4027026 - May 2012 (1 comment)

> Twelve Factors of Web Application Development - https://news.ycombinator.com/item?id=3267187 - Nov 2011 (37 comments)

_superposition_ yesterday at 3:07 PM

Still relevant.

luciandan yesterday at 8:19 PM

I love it how this is still at thing. Good principles never die, just like good music I guess.

lxe yesterday at 8:23 PM

I know that all of this is super relevant, but it's extremely aspirational, and I can pick apart pretty much every one of these factors on how it doesn't fully hold up when it comes to the reality of production applications.

Tomte yesterday at 3:42 PM

Every time it gets posted I read through the list and think "export services via port binding… of course a web server binds to a port, of course it‘s decoupled that way, what else would you do" and "treat backing services as attached resources… huh, is that really only about not linking in a database, but connecting using a JDBC string, for example?"

So let me ask for once: what am I missing? Why is that interesting and not trite?

deleted yesterday at 11:01 PM

bad_username yesterday at 5:34 PM

> X. Dev/prod parity Keep development, staging, and production as similar as possible

Notably, there is no requirement or recommendation that the dev environment be a single, shared environment. Development processes where this environment is single is shared is as terrible as it is ubiqitous.

phoneafriend yesterday at 4:35 PM

Yeah this is good stuff. Shocked to click around the site and find Intuit [working to follow] it. Today they get a nod.

Tomorrow it's back to wondering why they needed 10 GUI revisions and a 65% price hike in the past year alone.

[palms forehead; returns to coffee + codebase]

Exoristos yesterday at 4:35 PM

While this is and has always been outstanding advice, be aware different readers tend to comprehend that advice differently. Make sure you understand your approach moving forward; do further research and hold discussions with seniors.

nnutter yesterday at 3:53 PM

Note that at the bottom of a page is a "Download ePub Book" link, <https://12factor.net/12factor.epub>.

n4pw01f yesterday at 5:54 PM

Used to follow this to a T. Love 12factor, evangelized it at a lot of companies too

arun6582 yesterday at 7:17 PM

I read this 6 years ago. I’m glad to see this again

naniel yesterday at 5:06 PM

I was really hoping this would be about 12-factor authentication

rietta yesterday at 3:27 PM

Oh! That's a term I have not heard in a long time!

pjs_ yesterday at 6:46 PM

Imperfect but certified classic

gaigalas today at 12:07 AM

2025?

whalesalad yesterday at 6:47 PM

When people ask me what my religious beliefs are, this is what I respond with.

greenie_beans yesterday at 4:06 PM

need something better than the .env honeypot in this AI age. but idk what that might be

Juliate yesterday at 5:47 PM

There is a GitHub repo with updates: https://github.com/twelve-factor/twelve-factor

dankobgd yesterday at 3:44 PM

twelfth repost

jasonpeacock yesterday at 3:29 PM

It’s always new for someone…

https://xkcd.com/1053/

IshKebab yesterday at 9:47 PM

Storing config in environment variables is just such an incredibly obviously awful thing to do I can't recommend that anyone listens to this advice. Maybe some of the other things are good practice... honestly I don't remember... but once I saw that I immediately noped out.

Would you get advice from an antivaxxer? Like, maybe they do have good advice but it's still a good idea to get your advice elsewhere!

manganate06 yesterday at 8:08 PM

[flagged]

cryptolobster yesterday at 11:55 PM

[dead]

deleted yesterday at 9:13 PM