N100FN100F
Published on

Build once, deploy by digest

If what gets deployed to production is different from what was tested in acceptance, then acceptance was worth nothing. Building once and always moving the same artefact, identified by its digest, closes that door.

Service line Platform Engineering

'It worked in testing'

It is one of the most repeated sentences in any incident. And it is almost always true: what worked in testing was not exactly what was deployed to production. It was recompiled, a dependency was updated in between, the 'latest version' tag was already pointing at something else.

The artefact's digest

What was tested is what is deployedRebuilding takes something untested to production; deploying by digest takes exactly what was approved.PLATFORM · DEPLOYMENTWhat was tested is what is deployedRebuilding or using 'latest version'DEVELOPMENTsha256:4f1a…ACCEPTANCEsha256:4f1a…PRODUCTIONsha256:9c07…Production received something nobody tested.Build once, deploy by digestDEVELOPMENTsha256:4f1a…ACCEPTANCEsha256:4f1a…PRODUCTIONsha256:4f1a…The gate approved that digest; that digest is what runs.Rollback = redeploy the previous digest, which still exists untouched.Example digestsN100F · n100f.com

When an application is packaged (as a container image, for instance), the result has a unique cryptographic digest: an identifier calculated from its exact content. If a single byte changes, the digest changes.

Deploying by digest means:

  1. It is built once, in a controlled environment, for the target architecture.
  2. The digest of what was built is recorded.
  3. Each environment receives that same artefact by its digest, not by a name or a tag that can change.
  4. The production gate approves a specific digest: the one that passed acceptance.

Human-readable tags ('version 2.3') remain useful for people, but they do not decide what gets deployed.

What you gain

  • What was approved is what is deployed, with no room for doubt.
  • Rollback is immediate: you redeploy the previous digest, which still exists exactly as it was.
  • Traceability is complete: from a digest you reach the code, the build and the approval that took it to production.

The artefact being identical across every environment only makes sense if the environments resemble each other too. That is the next step.

How we apply it: Platform Engineering.

If your cloud cost keeps growing and nobody knows why, or your architecture depends on whoever built it, let’s talk.

Let’s talk