A deploy is a change to a running system, not a copy of files onto a disk. The bytes arriving is the easy half. The hard half is everything already in motion, all on its own schedule: names cached in resolvers you do not control, responses stored around the world, certificates with expiry dates, requests mid-flight, and a database that will not reverse when your code does. What follows is that second half — what changes the moment you release, what changes minutes later, and what never changes back.
Each chapter opens with the short version. Tap one to read the detail.
Your domain is a delegation, and changes expire rather than travel
~2 min
"Propagation" sounds like an update crossing the internet. Nothing crosses anything: resolvers reuse the answer they hold until the lifetime you published *before* the change expires — so the old setting governs the switch.
The padlock describes one leg of the trip
~2 min
A certificate is a signed claim that a key belongs to a hostname, and the padlock reports only on the browser's own connection. Behind a proxy there are two legs — the second can be plaintext while the first shows a lock.
A shared cache is one copy per location, and the key decides who shares it
~2 min
Caching reads like a switch you flip for the site. It is one copy per location, admitted only when the response permits storing and shared only between requests whose cache key matches exactly — so one extra header there can halve your hit rate.
What sits between the reader and your server
~2 min
Before any of your code runs, a client resolves a name, connects, completes a handshake and sends a request — four steps that fail in four unrelated ways. In front of them sits a proxy deciding which of your machines, if any, hears about it.
Where the work happens, and what the meter counts
~2 min
The choice is not static versus dynamic but *when* each page is computed — at build, in the background, or during the request. That sets your failure surface and your bill together: a page nobody computes costs nothing and cannot crash.
Compute is disposable; state has to live somewhere that isn't
~2 min
Every deploy replaces the instances, so anything written to local disk is gone — and was never visible to the others anyway. Moving it to a globally replicated store fixes durability and hands you a read allowed to be a minute stale.
The artifact: layers you cannot un-write, and a name that can move
~2 min
An image is a stack of immutable layers, so deleting a file later leaves the earlier layer untouched — and build arguments are recorded in the image history. A credential that ever entered the build stays extractable from the finished image.
Anything read at build time is frozen into the artifact
~2 min
An environment variable feels like runtime configuration. A value read during the build is baked into the output instead, so the artifact cannot be re-pointed afterwards — and if it reached client code, it was not configured, it was published.
Build once, promote the bytes
~2 min
"Works locally" is a statement about your machine, and rebuilding per environment quietly makes it one about your build server too. The pipeline's job is to produce a single artifact and move that same artifact forward.
Rollback is a plan, and half of it does not roll back
~2 min
The revert button covers your code and nothing else. Rolling back is fast precisely because it only re-points traffic at an artifact that still exists — while the migration you applied and the emails you sent stay where they are.
A deploy is a measurement, or it is a guess
~2 min
A green build tells you an artifact was produced, not that it works. The only signal that settles it comes from production — and must be attributable to a specific deployment, or you cannot tell a bad release from a bad Tuesday.
Written by Keentune. We are not affiliated with or endorsed by the organizations whose documentation informs this guide, and any linked sources belong to their respective owners.
All exam, test, and product names and trademarks are the property of their respective owners and are used here for identification and reference only. Keentune is independent study practice — not affiliated with, authorized, or endorsed by any of these organizations.