How a drain file and pre-stop hook finally achieved zero-downtime Docker Compose deploys

·1 views

A developer running a single-VPS Docker Compose stack with Traefik discovered that deploys were silently dropping requests despite using the docker-rollout tool, which handles container swaps but does not drain the old container before removal. Load testing under constant traffic revealed that Traefik continued routing requests to the old container right up until it was deleted, causing 502 errors on every deploy. The fix involved a marker-file-based healthcheck and a pre-stop hook that signals Traefik to stop sending traffic, then waits long enough for all in-flight requests to complete before the container is removed. After adding connection draining, the same load test recorded zero dropped requests. The developer packaged the full deployment flow — including registry login, migrations, ordered rollout, draining, and automatic rollback — into an open-source GitHub Action called docker-rollout-action.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developer Builds Incident-Recovery Agent That Validates Memory Before Applying Fixes

A developer built AfterTrace, a command-line incident-recovery tool, after their AI agent nearly applied a wrong fix by relying on a past solution for a similar-looking but different bug. The agent had previously fixed a failing search query by correcting a misconfigured alias, but in a repeat incident the alias was already correct and the real culprit was a stale cache. To prevent such errors, AfterTrace follows a principle where recalled fixes only guide what to investigate first, not what to change. Before applying any stored fix, the agent re-checks the current live state to confirm the fix still applies, rejecting it outright if conditions have changed. The developer plans to expand fault-type coverage and log rejected recalls so the agent can also learn from its own corrections.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Google's goto Redirect Wraps Organic Links in US, Affecting Analytics Not Rankings

Google has nearly completed rolling out google.com/goto redirect wrappers for organic search result links in the United States as of late August 2026, adding an intermediary Google URL before users reach their destination. The change does not alter how pages are ranked; it only modifies the click path a user travels before landing on a website. However, the extra redirect hop can cause discrepancies in analytics tools, rank trackers, and SERP APIs that do not correctly follow the redirect to its final destination URL. Google Search Console is unaffected in terms of its core reporting logic, as it already groups performance data by the final resolved URL after redirects. Site owners are advised to audit their measurement workflows — comparing GA4, Search Console, and third-party SEO platforms — to ensure each system is consistently recording the final destination rather than the intermediary Google URL.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Apache Foundation Completes AI-Powered Security Scans Across 230 Repositories

The Apache Software Foundation (ASF) conducted full security scans across 230 of its code repositories during a three-day window in August 2026. The work was carried out jointly by the ASF Security and ASF Tooling teams under the Foundation's Responsible AI Initiative, using Anthropic's Claude Mythos 5 via a program called Project Glasswing. The effort was partly motivated by a rise in low-quality AI-generated vulnerability reports reaching open-source projects, prompting ASF to run its own rigorous, context-aware scans internally. Scanning was powered by an automated pipeline built on the Gofannon agent platform, evaluating code against the OWASP Application Security Verification Standard across three model tiers of increasing analytical depth. Findings are now being disclosed to the respective project teams through official ASF channels, with remediation already underway, and the initiative was made possible in part by a donation from Anthropic.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why Encryption Needs a Unique Nonce Every Time, Even With the Same Password

In modern symmetric encryption, a nonce — a randomly generated value mixed into each encryption call — ensures that identical messages encrypted with the same key still produce different ciphertexts every time. Without this, an attacker monitoring encrypted traffic could detect patterns and infer information without ever cracking the key itself. In AES-GCM, a 12-byte nonce generated via os.urandom() is prepended to each encrypted output and passed back during decryption, where its role is uniqueness rather than secrecy. Reusing a nonce even once under the same key can fully compromise the confidentiality of affected messages and potentially expose the authentication key used for tamper detection. Nonce reuse is among the most common real-world implementation flaws in otherwise well-designed encryption systems, making proper random generation on every encrypt call a non-negotiable requirement.

0 comments Read more at DEV Community