Deploying by replacing running instances in place means every release has a window where failure is visible to users and rollback means another deploy. Blue-green and canary releases both remove that window, in different ways.
The two approaches
-
Blue-green
Stand up a complete second environment, test it, switch traffic across at once. Rollback is switching back. Simple to reason about; you pay for two environments briefly.
-
Canary
Send a small slice of traffic to the new version, watch the metrics, increase gradually. Catches problems that only appear under real traffic; requires good observability.
The database is the hard part
Both strategies assume old and new versions can run simultaneously against the same data. That constrains schema changes, and it is where most attempts come unstuck.
- Add new columns as nullable, with defaults. Never rename in one step.
- Deploy code that writes both old and new shapes while reading the old.
- Backfill existing rows in batches.
- Deploy code that reads the new shape.
- Once no version reads the old shape, remove it in a later release.
This expand-and-contract pattern takes several releases, which feels slow until the first time it lets you roll back a bad deploy instantly.
What to watch during a canary
| Signal | Why it matters |
|---|---|
| Error rate by version | The most direct indicator; compare, do not eyeball. |
| Latency percentiles | Averages hide the regression users notice. |
| Saturation | New version may use more memory or connections per request. |
| Downstream error rates | A change can overload a dependency. |
| A key business metric | Technically healthy releases can still be wrong. |
Which to choose
Blue-green suits releases where the change is large and you want a single clean switch. Canary suits frequent, incremental releases where subtle regressions matter more than dramatic ones. Many teams use blue-green for infrastructure changes and canary for application releases.
Summary
Pick the strategy that matches your release rhythm, make schema changes backwards compatible, and decide the abort criteria in advance. The deployment mechanism is straightforward; the data discipline is what makes it work.
