activestorage-hotcell-client

https://github.com/basecamp/hotcell

The three classes an application configures Rails with, so that variants, image analysis, and previews happen in an unprivileged container instead of in the application process. It also closes what Rails leaves open on that path: the built-in analyzers go silent when variant_processor is a class, the built-in previewers answer accept? by shelling out to look for a binary that is no longer there, and none of the jobs retries anything a cell can transiently answer.