One software upgrade caused three separate cluster outages with unrelated root causes

A self-hosted two-node cluster suffered three distinct failures after a single orchestrator upgrade, each with a different root cause. The first failure stemmed from a glibc version mismatch, as the official binary required glibc 2.32 while the older Ubuntu 20.04 node only provided 2.31, requiring a custom container build. The second failure was a systemd cgroup limit being hit on a Virtuozzo container, where leaked SSH session scopes had silently consumed all 100 available cgroup slots, causing any new service to exit with status 219. The third failure left all domains returning 404 errors even though containers were running correctly, because the orchestrator's state had fallen out of sync with the actual container status. Each issue required a separate diagnosis and fix, illustrating how a single upgrade can expose multiple unrelated environmental vulnerabilities at once.