Containers & Deploy Highlights Summary

Every highlight bullet from the 10 pages in this section, gathered on one page and grouped by the page it came from.

The Deployment Artifact Model: Build Once, Configure at Runtime

• A deployment artifact is built once and promoted unchanged - staging and prod run the identical image
• Configuration lives outside the artifact, injected at runtime through env vars or a secrets store
• The orchestrator's contract with your process is start, health-check, signal, replace - not edit in place
• Docker, Lambda, and Kubernetes are different orchestrators wrapping the same artifact-and-contract model
• Zero-downtime deploys work by replacing instances of the artifact, never patching a running one

Deployment Basics

• WSGI for sync Django/Flask; ASGI for async FastAPI
• One app process per container worker is the common model
• Bind to 0.0.0.0 behind a reverse proxy in production
• Health endpoints belong in every deployable service

Dockerizing Python

• Use slim bases, multi-stage builds, non-root users, and pinned deps for small images
• Copy lockfiles first, then install dependencies to avoid cache busting on code changes
• Run containers as non-root user to reduce container escape risk
• Exclude dev dependencies from production to reduce bloat and attack surface
• Use 0.0.0.0 instead of 127.0.0.1 for application binding in container
• Inject secrets at runtime from secret store, not in ENV or layers

Gunicorn & Uvicorn

• Gunicorn with UvicornWorker enables multi-process concurrency and async I/O for production FastAPI
• Tune workers starting at CPU count for I/O-bound workloads, half for CPU-bound sync apps
• Set timeout above p99 request time to avoid killing legitimate slow requests
• Never run uvicorn --reload in production as it is insecure and unstable
• Graceful shutdown requires both --graceful-timeout flag and Kubernetes preStop hook
• UvicornWorker supports websockets while sync Gunicorn workers do not

AWS Lambda & Serverless

• Reuse boto3 clients at module scope to survive warm invocations
• Import heavy libs like pandas lazily inside handler to avoid cold start delays
• Use /tmp for temp files only, persist to S3 since filesystem is read-only
• Choose zip with layers for small deps or container images for stacks over 250MB
• Ensure required env vars are present at cold start or requests will fail
• Add DLQ to SQS event sources for async invokes to avoid losing failures

Kubernetes for Python Apps

• Set maxUnavailable: 0 to maintain capacity during rollouts
• Separate liveness and readiness probes to prevent cascade restarts
• Use preStop sleep for graceful Gunicorn shutdown before SIGTERM
• Configure HPA to autoscale on CPU, requests per pod, or metrics
• Use immutable image digest tags to prevent unpredictable rollouts
• Run database migrations in Kubernetes Job init, not in web pods

CI/CD Pipelines

• Pin Python 3.14.0 in CI workflows and Docker to prevent subtle runtime bugs
• Tag images with github.sha for immutable artifact traceability and safe rollback
• Use OIDC role assumption instead of static AWS keys to secure CI credentials
• Gate production deploys with environment approval rules and post-deploy smoke tests
• Run uv sync --frozen in CI to match local lockfile, aligning dev and pipeline
• Manage database migrations as separate jobs before traffic shifts to avoid coupling

Configuration & Secrets in Prod

• Load secrets from environment with Pydantic, never bake into container images
• Use SecretStr to prevent secrets leaking in logs and repr output
• Never commit .env files to production images, use platform injection
• Exclude secrets when dumping settings to prevent accidental logging
• Use environment-specific secrets in deploy manifests, not baked config
• Pydantic settings provide validation and types over raw os.environ

Zero-Downtime Deploys

• Use rolling updates, graceful draining, and backward-compatible schema changes to eliminate 502s
• Deploy backward-compatible migration first, then roll out new version, then run forward-only cleanup
• preStop sleep should last 10-30 seconds, longer than load balancer deregistration and p99 requests
• Never deploy breaking migrations and new code in the same release; use expand-contract pattern
• Graceful shutdown drains connections before SIGTERM: LB deregister, preStop wait, then worker exit
• Set maxUnavailable to 0 with surge to maintain full capacity; 50% leaves half gone during deploy

Deployment Best Practices

• Immutable image tags per release
• Health probes separate liveness and readiness
• Secrets injected at runtime, never baked in
• Migrations backward-compatible across rollouts