Relay Deploy

FROM python:3.12-slim AS builder
WORKDIR /app
RUN pip install uv
COPY pyproject.toml uv.lock ./
RUN uv sync --frozen --no-dev

FROM python:3.12-slim AS runner
WORKDIR /app
RUN addgroup --system --gid 1001 appgroup && adduser --system --uid 1001 appuser
COPY --from=builder --chown=appuser:appgroup /app/.venv ./.venv
COPY --chown=appuser:appgroup . .
USER appuser
EXPOSE 8000
ENV PATH="/app/.venv/bin:$PATH"
CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8000"]

FROM golang:1.23-alpine AS builder
WORKDIR /app
COPY go.mod go.sum ./
RUN go mod download
COPY . .
RUN CGO_ENABLED=0 GOOS=linux go build -ldflags="-w -s" -o /app/server ./cmd/server

FROM scratch
COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
COPY --from=builder /app/server /server
EXPOSE 8080
ENTRYPOINT ["/server"]

.git
node_modules
.venv
__pycache__
*.pyc
target
.env
.env.*
.DS_Store
*.test
*.md
.github
.gitlab
docs
coverage

# cloudrun-service.yaml
apiVersion: serving.knative.dev/v1
kind: Service
metadata:
  name: your-service # configure
  annotations:
    run.googleapis.com/ingress: all
spec:
  template:
    metadata:
      annotations:
        autoscaling.knative.dev/minScale: "1"
        autoscaling.knative.dev/maxScale: "10"
        run.googleapis.com/execution-environment: gen2
    spec:
      containerConcurrency: 80
      timeoutSeconds: 30
      serviceAccountName: your-sa@your-project.iam.gserviceaccount.com # configure
      containers:
        - image: us-central1-docker.pkg.dev/your-project/your-repo/your-service:latest
          ports:
            - containerPort: 8080
          resources:
            limits:
              cpu: "1"
              memory: 512Mi
          env:
            - name: NODE_ENV
              value: production
            - name: DATABASE_URL
              valueFrom:
                secretKeyRef:
                  name: database-url # configure in Secret Manager
                  key: latest
          readinessProbe:
            httpGet:
              path: /health
            initialDelaySeconds: 5
            periodSeconds: 10
  traffic:
    - percent: 100
      latestRevision: true

# After deploying the new revision with --no-traffic:
gcloud run deploy your-service \
  --image IMAGE_URL \
  --no-traffic \
  --tag canary \
  --region us-central1

# Split traffic: 10% to canary, 90% to stable
gcloud run services update-traffic your-service \
  --to-tags canary=10,stable=90 \
  --region us-central1

# Promote to 100% after validation:
gcloud run services update-traffic your-service \
  --to-latest \
  --region us-central1

app = "your-app"         # configure
primary_region = "iad"   # configure

[build]

[http_service]
  internal_port = 8080
  force_https = true
  auto_stop_machines = "stop"
  auto_start_machines = true
  min_machines_running = 1

[[http_service.checks]]
  grace_period = "5s"
  interval = "10s"
  method = "GET"
  path = "/health"
  timeout = "2s"

[deploy]
  strategy = "rolling"

[[vm]]
  size = "shared-cpu-1x"
  memory = "512mb"

apiVersion: apps/v1
kind: Deployment
metadata:
  name: your-service
  labels:
    app: your-service
spec:
  replicas: 2
  selector:
    matchLabels:
      app: your-service
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 0 # zero-downtime: never kill old before new is ready
  template:
    metadata:
      labels:
        app: your-service
    spec:
      containers:
        - name: your-service
          image: your-registry/your-service:latest
          ports:
            - containerPort: 8080
          resources:
            requests:
              cpu: 100m
              memory: 128Mi
            limits:
              cpu: 500m
              memory: 512Mi
          readinessProbe:
            httpGet:
              path: /health
              port: 8080
            initialDelaySeconds: 5
            periodSeconds: 5
            failureThreshold: 3
          livenessProbe:
            httpGet:
              path: /health
              port: 8080
            initialDelaySeconds: 15
            periodSeconds: 20
          env:
            - name: DATABASE_URL
              valueFrom:
                secretKeyRef:
                  name: your-service-secrets
                  key: database-url

# List recent revisions
gcloud run revisions list --service your-service --region us-central1

# Route 100% traffic to the previous stable revision
gcloud run services update-traffic your-service \
  --to-revisions your-service-00042-abc=100 \
  --region us-central1

# Verify traffic is fully shifted
gcloud run services describe your-service --region us-central1 | grep traffic

# List recent releases
flyctl releases list

# Roll back to previous release
flyctl deploy --image registry.fly.io/your-app:deployment-XXXXXXXXXX

# Or use the image digest from `flyctl releases list`

# Check rollout status
kubectl rollout status deployment/your-service

# Roll back to previous version immediately
kubectl rollout undo deployment/your-service

# Roll back to a specific revision
kubectl rollout history deployment/your-service
kubectl rollout undo deployment/your-service --to-revision=3

# Verify pods are healthy
kubectl get pods -l app=your-service

#!/usr/bin/env bash
# smoke-test.sh — run after every deploy
set -euo pipefail

BASE_URL="${1:-https://your-service.example.com}"
MAX_LATENCY_MS=500

echo "Running smoke tests against $BASE_URL..."

# Health check
STATUS=$(curl -s -o /dev/null -w "%{http_code}" "$BASE_URL/health")
[ "$STATUS" = "200" ] || { echo "FAIL: /health returned $STATUS"; exit 1; }

# Latency check
LATENCY=$(curl -s -o /dev/null -w "%{time_total}" "$BASE_URL/health")
LATENCY_MS=$(echo "$LATENCY * 1000" | bc | cut -d. -f1)
[ "$LATENCY_MS" -lt "$MAX_LATENCY_MS" ] || { echo "FAIL: /health latency ${LATENCY_MS}ms > ${MAX_LATENCY_MS}ms"; exit 1; }

# Version check (optional — requires /version or X-Version header)
# VERSION=$(curl -s "$BASE_URL/version" | jq -r .version)
# [ "$VERSION" = "$EXPECTED_VERSION" ] || { echo "FAIL: wrong version $VERSION"; exit 1; }

echo "OK: all smoke tests passed"

┌─ Deployment config written ─────────────────────────────────┐
│                                                              │
│  Strategy:   rolling (Cloud Run)                             │
│  Files:      Dockerfile                                      │
│              .dockerignore                                   │
│              cloudrun-service.yaml                           │
│              scripts/smoke-test.sh                           │
│                                                              │
│  Deploy:     gcloud run services replace cloudrun-service.yaml │
│  Rollback:   gcloud run services update-traffic ... (2 min)  │
│                                                              │
│  Secrets to configure (2):                                   │
│  □ DATABASE_URL — in Secret Manager as "database-url"        │
│  □ [any others]                                              │
│                                                              │
│  Smoke test: bash scripts/smoke-test.sh https://your-url     │
└──────────────────────────────────────────────────────────────┘