Compose readiness and partial rollback boundaries
A running container may still lack a database connection, required tables, or an internal dependency. Liveness says the process is alive; readiness says it can receive user traffic.
A running container may still lack a database connection, required tables, or an internal dependency. Liveness says the process is alive; readiness says it can receive user traffic.
A safe image replacement
Create an immutable image for the changed Git SHA.
Recreate only the target service with the new image.
Check the process, database, required dependencies, and public smoke.
Keep the image only when every gate passes; otherwise restore the previous one.
Public boundary and readiness
The production environment keeps the public entry at Caddy and binds app, database, Kafka, and Prometheus ports to loopback or the internal network. Java Actuator and Python /metrics are internal scrape paths, while Caddy blocks public management routes. Prometheus starts only in the optional observability profile.
Shared storage and rollback
| Signal | Meaning | Traffic decision |
|---|---|---|
| Process running | Liveness | Do not route yet |
| Database and dependencies ready | Readiness | Route traffic |
| New image fails readiness | Failed release | Keep the previous image |
The console writes the public-content host path and the public app mounts that same path read-only. A mismatch would make an upload appear successful while the public page cannot read it.
On failure, replace and roll back only target images rather than stopping the whole stack. Preserve logs and readiness results so the operator can judge impact and recovery.
Related course: Compose, readiness, reverse proxy, and rollback
Verification covers the public health response, a failed readiness state when an internal dependency is removed, and recovery after restoring the previous image.