Essential session storage is required to sign in. Optional analytics remain off unless you allow them.
Take any small web app: Dockerize it (multi-stage, non-root, pinned base), compose it with its database, build a CI pipeline (lint/test/build → SHA-tagged image), and deploy to a VPS or cloud VM behind a reverse proxy with TLS, health-gated cutover, and a scripted, rehearsed rollback. Include the runbook.
Deterministic CI gates; build-once promote-by-SHA; secrets never in the repo or logs.
Health-checked cutover; automatic or one-command rollback; migrations decoupled from rollback.
Key-only SSH, firewall default-deny, non-root containers, TLS automated.
Deploy, rollback, logs, and restore documented well enough for a stranger at 2am.
Use this README structure to make the work reviewable.
DevPath fetches a read-only, size-capped snapshot. Submitted code is never executed.
# Zero-downtime deploy pipeline for a containerized app ## Goal Take any small web app: Dockerize it (multi-stage, non-root, pinned base), compose it with its database, build a CI pipeline (lint/test/build → SHA-tagged image), and deploy to a VPS or cloud VM behind a reverse proxy with TLS, health-gated cutover, and a scripted, rehearsed rollback. Include the runbook. ## Acceptance criteria - [ ] Pipeline quality: Deterministic CI gates; build-once promote-by-SHA; secrets never in the repo or logs. - [ ] Deploy safety: Health-checked cutover; automatic or one-command rollback; migrations decoupled from rollback. - [ ] Host hardening: Key-only SSH, firewall default-deny, non-root containers, TLS automated. - [ ] Runbook: Deploy, rollback, logs, and restore documented well enough for a stranger at 2am. ## Verification - [ ] Document installation and run commands. - [ ] Record automated checks and their exact commands. - [ ] Add representative output, screenshots, or a short demo where useful. - [ ] Confirm failure paths and known constraints. ## Decision log ### Decision title - Context: - Choice: - Alternatives considered: - Tradeoffs: ## Evidence - Link each rubric criterion to the file, test, or artifact that demonstrates it. ## Known limitations - List what is intentionally out of scope and what should be improved next.