Bundler vs RubyGems: How Ruby Dependencies Work in CI
These are not really rivals: RubyGems installs gems, Bundler pins and resolves them - and in CI you almost always want Bundler on top.
RubyGems is Ruby's package manager and registry client (gem install). Bundler sits on top, resolving a consistent set of gems from a Gemfile and locking them in Gemfile.lock for reproducible installs.
| RubyGems | Bundler | |
|---|---|---|
| Role | Install individual gems | Resolve + lock a dependency set |
| Lockfile | None | Gemfile.lock |
| Reproducible installs | Only if you pin manually | Yes (from the lock) |
| CI command | gem install <gem> | bundle install / bundle ci |
| Relationship | Underlying layer | Built on RubyGems |
In CI
For applications you want Bundler: commit Gemfile.lock and run bundle install (with --deployment / frozen settings) so every pipeline gets identical gem versions. Bare gem install is fine for installing standalone CLI tools in a job, but it does not give you a reproducible project environment. Bundler uses RubyGems underneath - they cooperate rather than compete.
Cache the gems
Cache the vendor/bundle (or gem) directory keyed on Gemfile.lock and set bundle path so installs are restored, not refetched. Whichever Ruby version you target, the install runs on CI runners; faster managed runners help when native gem compiles dominate.
Decide with your own numbers, not a feature table
Feature comparisons age badly and rarely decide anything, because both tools in a mature category can do the job. What differs is how each behaves on your repository, and that takes one afternoon to measure.
# time a cold install with each candidate, cache cleared
hyperfine --prepare "rm -rf node_modules" --warmup 1 \
"<tool-a> install" "<tool-b> install"
# and the thing CI actually pays for: a cold run with no local cache
docker run --rm -v "$(pwd):/w" -w /w node:22 sh -c "<tool> install"What actually changes when you switch
- Lockfile format. A switch is a one-way door for anyone still on the old tool until everyone migrates, so plan it as a single coordinated change.
- Resolution strictness. Tools differ on whether an undeclared transitive import works, and the stricter one will surface latent bugs as new failures.
- CI cache configuration. The cache path and key differ per tool; carrying over the old ones silently disables caching.
- Everyone on the team and every runner must move together. Pin the version so they cannot drift.
The verdict
Building a Ruby app: use Bundler with a committed Gemfile.lock for reproducible installs. Just need a standalone tool in a job: gem install is enough. They are layers, not alternatives - Bundler is the right default for projects.