Twelve-factor app: Twelve rules for cloud applications

In short: A set of twelve principles by which applications can be easily operated, scaled and delivered in the cloud.

In more detail: The “twelve-factor app” was formulated around 2011 by developers of the Heroku platform. It describes how to build software as a service that can be started on new servers without manual work, run several times in parallel and updated often. Many of the rules still apply unchanged today to containers and Kubernetes.

In Depth

The twelve factors in brief

1. Codebase: one codebase in version control, many deploys.
2. Dependencies: declare explicitly and isolate (e.g. package.json).
3. Config: in environment variables, not in code.
4. Backing services: treat database, mail etc. as replaceable attached resources.
5. Build, release, run: separate strictly.
6. Processes: stateless, store data in a service.
7. Port binding: the service exposes itself through a port.
8. Concurrency: scale out through more processes.
9. Disposability: start quickly, shut down cleanly.
10. Dev/prod parity: keep environments as similar as possible.
11. Logs: write as a stream of events to stdout.
12. Admin processes: one-off tasks (migrations) as separate processes.

Example: configuration

Instead of writing the database address into the code:

const db = connect(process.env.DATABASE_URL);

The same code then runs locally, in testing and in production; only the environment variable differs. Secrets do not belong in the repository.

Why stateless matters

If a process stores sessions in its own memory, something is lost on restart, and a load balancer cannot distribute requests freely. If the state is in a database or in Redis, processes can be started and stopped at will.

Classification

The rules are guidelines, not laws. Especially for factor 11 (logs) and factor 3 (environment variables) there have been developments, such as structured logs and secret management instead of many environment variables.

See also: Environment variables, Docker, CI/CD pipeline, Health checks and graceful shutdown