Promote one build artifact unchanged through dev, staging, and prod

It worked in staging yesterday. Today the same code, rebuilt for prod, does something different.

Intermediate to advancedRead 7 minDoing: half a day, mostly spent waiting through each environment's own checks between deploys8 steps

▶ Start

What you'll have at the end

One container image, built once and tagged by commit, that a pipeline promotes through every environment unchanged

Before you start

You need

A backend service that already builds into a container image and deploys through an automated pipeline, with that image already free of baked-in secrets and not running as root.

Not covered

Which rollout strategy an environment applies once it is running this artifact, or how to reverse a bad release: this recipe only makes sure every environment runs the identical bytes.

Leans on

8 steps

Where to go next

Gate a canary rollout on one metric

once the promoted digest reaches an environment, this is what actually controls how much live traffic reaches it.

Does your rollback restore the last working version?

if the promoted digest turns out to be bad, this is what reverses it.

Checked 20 Aug 2026

Part of the Backend Deployment cookbook