Deploys should be boring. Ours weren't — a rolling restart could strand traffic on a dying process for up to thirty seconds. So we went back to first principles.
The atomic swap
Build into a versioned directory, flip one symlink, reload. The swap is a single syscall — there is no in-between state to observe.
- Versioned release directories
- One symlink as the source of truth
- Health checks gate the flip
Rollbacks in one second
Keeping the last five releases on disk means rollback is just the same symlink flip, pointed backwards.
The best deployment system is the one whose failure modes you can enumerate on one hand.
What we measure
Deploy duration, time-to-first-healthy, and failed-deploy rate. If a metric can't page someone, we don't collect it.
ln -sfn releases/v142 current && systemctl reload app
