Compose readiness and partial rollback boundaries

A running container may still lack a database connection, required tables, or an internal dependency. Liveness says the process is alive; readiness says it can receive user traffic.

A safe image replacement

1Build

Create an immutable image for the changed Git SHA.

2Replace

Recreate only the target service with the new image.

3Prove readiness

Check the process, database, required dependencies, and public smoke.

4Promote or restore

Keep the image only when every gate passes; otherwise restore the previous one.

Public boundary and readiness

The production environment keeps the public entry at Caddy and binds app, database, Kafka, and Prometheus ports to loopback or the internal network. Java Actuator and Python /metrics are internal scrape paths, while Caddy blocks public management routes. Prometheus starts only in the optional observability profile.

Shared storage and rollback

The console writes the public-content host path and the public app mounts that same path read-only. A mismatch would make an upload appear successful while the public page cannot read it.

On failure, replace and roll back only target images rather than stopping the whole stack. Preserve logs and readiness results so the operator can judge impact and recovery.

Related course: Compose, readiness, reverse proxy, and rollback

Verification covers the public health response, a failed readiness state when an internal dependency is removed, and recovery after restoring the previous image.