Automatic rollback

update_config.failure_action decides what Swarm does when a new task fails during its monitor window: pause (default), continue, or rollback to the previous spec with rollback_config.

How it works

A failure is a new task that exits, becomes unhealthy or cannot start before monitor runs out. max_failure_ratio (0 by default) is the share of failed tasks tolerated. With failure_action: rollback, Swarm puts the previous spec back on its own; docker service rollback does the same by hand, and docker service inspect shows UpdateStatus.

What breaks

A version that dies after the monitor window counts as a success: the update completes and every replica crashes in turn. pause leaves the service half updated, with a broken task restarting, until someone notices. Set monitor longer than the time a bad release takes to show itself.

In compose.yaml

    deploy:
      update_config:
        parallelism: 1
        order: start-first
        monitor: 60s
        failure_action: rollback
      rollback_config:
        parallelism: 1
        order: start-first

See it break, then fix it

Write the Dockerfile or the compose file, type the docker commands, and watch a simulated server run them through reboots, upgrades and traffic. Free to start.

Open the learning path Open the sandbox