Graceful zero-downtime deploys
A new version goes live only after it passes a health check; the running version keeps serving until the swap completes.
Deploys are zero-downtime by default. A new version is started and health-checked before any traffic moves to it — the version that's already running keeps serving requests until the new one is confirmed healthy, then traffic swaps over cleanly.