Master

Deploying an app that must not break

A deploy replaces a process. The replacement has a moment where two versions exist, and the moment is the reason a deploy is a decision rather than an action.

What you will see

One line. The running app says its version, which is the check.

About 1 min of reading

Try It

Write the deploy order

1

Write the order

printf 'suite\nstart-new\ndrain-old\nexit-old\n' > /tmp/o.txt; cat -n /tmp/o.txt

Before you run it, say out loud what it will print. Then open the answer.

What it prints
Four numbered lines. The order is the contract of a deploy.
2

Attempt a version that fails the suite

printf 'suite fail=1\n' | awk '{print ($2=="fail=0") ? "start" : "no-start"}'

Before you run it, say out loud what it will print. Then open the answer.

What it prints
no-start. The version never starts, which is the gate working.
3

Stamp the running version

printf 'version=b7 date=2026-10-10\n' > /tmp/v.txt; cat /tmp/v.txt

Before you run it, say out loud what it will print. Then open the answer.

What it prints
One line. The running app says its version, which is the check.

Data Flow

A change to a safe start
1 The route contract is checked against the change
↓
2 The suite runs on the new version
↓
3 The new version starts and stamps itself
↓
4 The old version drains and exits
Why this works
Why the version is stamped on the app

The running app must say which version it is. A version only in the file is a version that cannot be checked in place.

The one artefact that must be shared

The route contract. Both versions are written against it, and it is the file that makes a break visible before it happens.

Examples

The old process is not killed first

The new one starts, then the old one drains, then the old one exits. The order is the whole contract of a deploy.

The suite gates the start

A version that fails the suite never starts. A version that never starts cannot be the one serving.

The rollback is the same shape

The previous version is kept. Kept means it can be started, and started means the fix is a start rather than a build.

Words this lesson uses

Each one is defined here on this site. Open the entry for the full definition and the other words it points at.

← Debugging an app that is running
Previous Lesson
Debugging an app that is running
Next Lesson
Shipping an app that is bounded
Shipping an app that is bounded →