Zero-downtime deploys
Drain + canary + auto-rollback
Every live deploy goes through a drain-and-swap sequence: the new container starts, passes its health check, takes over traffic via an atomic Caddy route swap, and only then is the old container stopped (after a 5-second drain window so in-flight requests complete cleanly).
A 30-second canary monitor probes the new version after the swap. If two probes return 5xx in a row, Percher automatically rolls back: restores the previous upstream, stops the failed container, and marks the deploy failed. You see this live in the dashboard as a stepper — Build → Start → Health check → Swap → Canary → Live — with a Rolled back row if the canary fired.
Opt out per-instance via PERCHER_CANARY_AUTO_ROLLBACK=false. Canary window and drain time can be tuned via PERCHER_CANARY_WINDOW_MS and PERCHER_DRAIN_GRACE_MS.
Post-deploy screenshots (preview). Once a deploy is live, Percher can capture a screenshot of your app and attach it to that deploy (surfaced as screenshotUrl on the deploy result). It's a preview feature, off by default, and strictly best-effort — a screenshot never delays or fails a deploy. Only public apps are captured; a password-protected or private app is skipped (Percher never logs in to take the shot). The capture hits your app's public URL through a locked-down headless browser that can only reach your own app's hosts — it can't be pointed at anything internal.