deployment-patterns

# Deployment Patterns Production deployment workflows and CI/CD best practices. ## When to Activate - Setting up CI/CD pipelines - Dockerizing an application - Planning deployment strategy (blue-green, canary, rolling) - Implementing health checks and readiness probes - Preparing for a production release - Configuring environment-specific settings ## Deployment Strategies ### Rolling Deployment (Default) Replace instances gradually — old and new versions run simultaneously during rollout. ``` Instance 1: v1 → v2 (update first) Instance 2: v1 (still running v1) Instance 3: v1 (still running v1) Instance 1: v2 Instance 2: v1 → v2 (update second) Instance 3: v1 Instance 1: v2 Instance 2: v2 Instance 3: v1 → v2 (update last) ``` **Pros:** Zero downtime, gradual rollout **Cons:** Two versions run simultaneously — requires backward-compatible changes **Use when:** Standard deployments, backward-compatible changes ### Blue-Green Deployment Run two identical environments. Switch traffic atomically. ``` Blue (v1) ← traffic Green (v2) idle, running new version # After verification: Blue (v1) idle (becomes standby) Green (v2) ← traffic ``` **Pros:** Instant rollback (switch back to blue), clean cutover **Cons:** Requires 2x infrastructure during deployment **Use when:** Critical services, zero-tolerance for issues ### Canary Deployment Route a small percentage of traffic to the new version first. ``` v1: 95% of traffic v2: 5% of traffic (canary) # If metrics look good: v1: 50% of traffic v2: 50% of traffic # Final: v2: 100% of traffic ``` **Pros:** Catches issues with real traffic before full rollout **Cons:** Requires traffic splitting infrastructure, monitoring **Use when:** High-traffic services, risky changes, feature flags ## Docker ### Multi-Stage Dockerfile (Node.js) ```dockerfile # Stage 1: Install dependencies FROM node:22-alpine AS deps WORKDIR /app COPY package.json package-lock.json ./ RUN npm ci --production=false # Stage 2: Build FROM node:22-alpine AS builder WORKDIR /app COPY --from=deps /app/node_modules ./node_modules COPY . . RUN npm run build RUN npm prune --production # Stage 3: Production image FROM node:22-alpine AS runner WORKDIR /app RUN addgroup -g 1001 -S appgroup && adduser -S appuser -u 1001 USER appuser COPY --from=builder --chown=appuser:appgroup /app/node_modules ./node_modules COPY --from=builder --chown=appuser:appgroup /app/dist ./dist COPY --from=builder --chown=appuser:appgroup /app/package.json ./ ENV NODE_ENV=production EXPOSE 3000 HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \ CMD wget --no-verbose --tries=1 --spider http://localhost:3000/health || exit 1 CMD ["node", "dist/server.js"] ``` ### Multi-Stage Dockerfile (Go) ```dockerfile FROM golang:1.22-alpine AS builder WORKDIR /app COPY go.mod go.sum ./ RUN go mod download COPY . . RUN CGO_ENABLED=0 GOOS=linux go build -ldflags="-s -w" -o /server ./cmd/server FROM alpine:3.19 AS runner RUN apk --no-cache add ca-certificates RUN adduser -D -u 1001 appuser USER appuser COPY --from=builder /server /server EXPOSE 8080 HEALTHCHECK --interval=30s --timeout=3s CMD wget -qO- http://localhost:8080/health || exit 1 CMD ["/server"] ``` ### Multi-Stage Dockerfile (Python/Django) ```dockerfile FROM python:3.12-slim AS builder WORKDIR /app RUN pip install --no-cache-dir uv COPY requirements.txt . RUN uv pip install --system --no-cache -r requirements.txt FROM python:3.12-slim AS runner WORKDIR /app RUN useradd -r -u 1001 appuser USER appuser COPY --from=builder /usr/local/lib/python3.12/site-packages /usr/local/lib/python3.12/site-packages COPY --from=builder /usr/local/bin /usr/local/bin COPY . . ENV PYTHONUNBUFFERED=1 EXPOSE 8000 HEALTHCHECK --interval=30s --timeout=3s CMD python -c "import urllib.request; urllib.request.urlopen('http://localhost:8000/health/')" || exit 1 CMD ["gunicorn", "config.wsgi:application", "--bind", "0.0.0.0:8000", "--workers", "4"] ``` ### Docker Best Practices ``` # GOOD practices - Use specific version tags (node:22-alpine, not node:latest) - Multi-stage builds to minimize image size - Run as non-root user - Copy dependency files first (layer caching) - Use .dockerignore to exclude node_modules, .git, tests - Add HEALTHCHECK instruction - Set resource limits in docker-compose or k8s # BAD practices - Running as root - Using :latest tags - Copying entire repo in one COPY layer - Installing dev dependencies in production image - Storing secrets in image (use env vars or secrets manager) ``` ## CI/CD Pipeline ### GitHub Actions (Standard Pipeline) ```yaml name: CI/CD on: push: branches: [main] pull_request: branches: [main] jobs: test: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - uses: actions/setup-node@v4 with: node-version: 22 cache: npm - run: npm ci - run: npm run lint - run: npm run typecheck - run: npm test -- --coverage - uses: actions/upload-artifact@v4 if: always() with: name: coverage path: coverage/ build: needs: test runs-on: ubuntu-latest if: github.ref == 'refs/heads/main' steps: - uses: actions/checkout@v4 - uses: docker/setup-buildx-action@v3 - uses: docker/login-action@v3 with: registry: ghcr.io username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - uses: docker/build-push-action@v5 with: push: true tags: ghcr.io/${{ github.repository }}:${{ github.sha }} cache-from: type=gha cache-to: type=gha,mode=max deploy: needs: build runs-on: ubuntu-latest if: github.ref == 'refs/heads/main' environment: production steps: - name: Deploy to production run: | # Platform-specific deployment command # Railway: railway up # Vercel: vercel --prod # K8s: kubectl set image deployment/app app=ghcr.io/${{ github.repository }}:${{ github.sha }} echo "Deploying ${{ github.sha }}" ``` ### Pipeline Stages ``` PR opened: lint → typecheck → unit tests → integration tests → preview deploy Merged to main: lint → typecheck → unit tests → integration tests → build image → deploy staging → smoke tests → deploy production ``` ## Health Checks ### Health Check Endpoint ```typescript // Simple health check app.get("/health", (req, res) => { res.status(200).json({ status: "ok" }); }); // Detailed health check (for internal monitoring) app.get("/health/detailed", async (req, res) => { const checks = { database: await checkDatabase(), redis: await checkRedis(), externalApi: await checkExternalApi(), }; const allHealthy = Object.values(checks).every(c => c.status === "ok"); res.status(allHealthy ? 200 : 503).json({ status: allHealthy ? "ok" : "degraded", timestamp: new Date().toISOString(), version: process.env.APP_VERSION || "unknown", uptime: process.uptime(), checks, }); }); async function checkDatabase(): Promise<HealthCheck> { try { await db.query("SELECT 1"); return { status: "ok", latency_ms: 2 }; } catch (err) { return { status: "error", message: "Database unreachable" }; } } ``` ### Kubernetes Probes ```yaml livenessProbe: httpGet: path: /health port: 3000 initialDelaySeconds: 10 periodSeconds: 30 failureThreshold: 3 readinessProbe: httpGet: path: /health port: 3000 initialDelaySeconds: 5 periodSeconds: 10 failureThreshold: 2 startupProbe: httpGet: path: /health port: 3000 initialDelaySeconds: 0 periodSeconds: 5 failureThreshold: 30 # 30 * 5s = 150s max startup time ``` ## Environment Configuration ### Twelve-Factor App Pattern ```bash # All config via environment variables — never in code DATABASE_URL=postgres://user:pass@host:5432/db REDIS_URL=redis://host:6379/0 API_KEY=${API_KEY} # injected by secrets manager LOG_LEVEL=info PORT=3000 # Environment-specific behavior NODE_ENV=production # or staging, development APP_ENV=production # explicit app environment ``` ### Configuration Validation ```typescript import { z } from "zod"; const envSchema = z.object({ NODE_ENV: z.enum(["development", "staging", "production"]), PORT: z.coerce.number().default(3000), DATABASE_URL: z.string().url(), REDIS_URL: z.string().url(), JWT_SECRET: z.string().min(32), LOG_LEVEL: z.enum(["debug", "info", "warn", "error"]).default("info"), }); // Validate at startup — fail fast if config is wrong export const env = envSchema.parse(process.env); ``` ## Rollback Strategy ### Instant Rollback ```bash # Docker/Kubernetes: point to previous image kubectl rollout undo deployment/app # Vercel: promote previous deployment vercel rollback # Railway: redeploy previous commit railway up --commit <previous-sha> # Database: rollback migration (if reversible) npx prisma migrate resolve --rolled-back <migration-name> ``` ### Rollback Checklist - [ ] Previous image/artifact is available and tagged - [ ] Database migrations are backward-compatible (no destructive changes) - [ ] Feature flags can disable new features without deploy - [ ] Monitoring alerts configured for error rate spikes - [ ] Rollback tested in staging before production release ## Production Readiness Checklist Before any production deployment: ### Application - [ ] All tests pass (unit, integration, E2E) - [ ] No hardcoded secrets in code or config files - [ ] Error handling covers all edge cases - [ ] Logging is structured (JSON) and does not contain PII - [ ] Health check endpoint returns meaningful status ### Infrastructure - [ ] Docker image builds reproducibly (pinned versions) - [ ] Environment variables documented and validated at startup - [ ] Resource limits set (CPU, memory) - [ ] Horizontal scaling configured (min/max instances) - [ ] SSL/TLS enabled on all endpoints ### Monitoring - [ ] Application metrics exported (request rate, latency, errors) - [ ] Alerts configured for error rate > threshold - [ ] Log aggregation set up (structured logs, searchable) - [ ] Uptime monitoring on health endpoint ### Security - [ ] Dependencies scanned for CVEs - [ ] CORS configured for allowed origins only - [ ] Rate limiting enabled on public endpoints - [ ] Authentication and authorization verified - [ ] Security headers set (CSP, HSTS, X-Frame-Options) ### Operations - [ ] Rollback plan documented and tested - [ ] Database migration tested against production-sized data - [ ] Runbook for common failure scenarios - [ ] On-call rotation and escalation path defined