contained, and recoverable.
Replace instead of repair
Mutable servers accumulate differences through package updates, emergency fixes, and configuration changes. Immutable deployment replaces an instance with a versioned image rather than modifying it in place.
That turns the image into a release artifact: the same tested bytes move through environments, and rollback means restoring a previous known version instead of reversing a sequence of changes.
Build a clean image pipeline
Create images from a minimal base, install only required dependencies, and run security and application tests before publishing. Attach a source revision and build record to every image so an operator can trace exactly what is running.
- Never place environment secrets inside an image.
- Keep startup work small and deterministic.
- Retain a limited set of known-good versions for rollback.
- Rebuild regularly to absorb base image security updates.
Roll out gradually and measure
Send a small portion of traffic to the new image, compare error rate and latency against the current version, and expand only when its health is clear. Automated rollback thresholds make this process both faster and safer.