The Gemfile lists the gems a project needs, where to get them, and the version ranges it accepts. Gemfile.lock records the exact version Bundler installed for every gem, including the gems those gems depend on.
When you run bundle install and the lock file still matches the Gemfile, Bundler installs exactly those versions. It skips dependency resolution, the step that picks one version of each gem to fit every range. That keeps every developer machine, build server and production host on the same gem versions. bundle update is the step that moves gems to newer versions and rewrites the lock file.
Commit both files for an application.
Rewriting in plainer words…
This answer doesn't lend itself to a diagram - it reads best . No credits were charged.
