Building a Zero-Downtime CI/CD Pipeline with GitHub Actions and Docker

A robust CI/CD pipeline is the backbone of modern software delivery. This guide walks you through building a pipeline that runs tests, builds a Docker image, and deploys to production with zero downtime using blue-green switching.

GitHub Actions Workflow Structure

name: Deploy to Production
on:
  push:
    branches: [main]

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Run Tests
        run: pytest tests/ -v

  build-and-push:
    needs: test
    runs-on: ubuntu-latest
    steps:
      - uses: docker/build-push-action@v5
        with:
          push: true
          tags: ghcr.io/mirahlabs/api:${{ github.sha }}

  deploy:
    needs: build-and-push
    runs-on: ubuntu-latest
    steps:
      - name: SSH Deploy
        uses: appleboy/ssh-action@master
        with:
          script: |
            docker pull ghcr.io/mirahlabs/api:${{ github.sha }}
            docker service update --image ghcr.io/mirahlabs/api:${{ github.sha }} api_service

Docker Multi-Stage Build

Use multi-stage builds to keep production images lean. A builder stage installs all dependencies; the final stage copies only the application code and runtime dependencies, reducing the image size by up to 70%.

Blue-Green Deployment

Run two identical production environments (blue and green). Deploy new code to the idle environment, run smoke tests, then switch the load balancer. If issues arise, flip back in under 30 seconds with no data loss.

Health Checks and Rollback

Always configure Docker health checks. If the new container fails its health check within the configured timeout, the deploy job should automatically trigger a rollback by redeploying the previous SHA tag.

Production Multi-Stage Dockerfile Blueprint

Below is a secure, multi-stage production Dockerfile designed to minimize image size and eliminate security vulnerabilities by running as a non-privileged user:

# Stage 1: Build virtual env
FROM python:3.11-slim AS builder
WORKDIR /app
RUN apt-get update && apt-get install -y --no-install-recommends gcc libpq-dev && rm -rf /var/lib/apt/lists/*
RUN python -m venv /opt/venv
ENV PATH="/opt/venv/bin:$PATH"
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt

# Stage 2: Final lightweight image
FROM python:3.11-slim
WORKDIR /app
RUN apt-get update && apt-get install -y --no-install-recommends libpq-dev && rm -rf /var/lib/apt/lists/*
COPY --from=builder /opt/venv /opt/venv
COPY . .
ENV PATH="/opt/venv/bin:$PATH"
ENV PYTHONUNBUFFERED=1
RUN useradd -u 10001 appuser && chown -R appuser:appuser /app
USER 10001
EXPOSE 8080
CMD ["gunicorn", "--bind", "0.0.0.0:8080", "run:app"]

Cloud Infrastructure Performance Profile

Below is a comparative latency and throughput profile of this infrastructure pattern deployed under a simulated load of 10,000 concurrent requests:

US & UK DevOps Governance & Infrastructure Security

Automating infrastructure and deployment workflows must respect regional privacy laws. Under the UK GDPR and US California Consumer Privacy Act (CCPA), system administrators must ensure that data pipelines respect strict boundaries regarding where user telemetry and system logs are stored (data residency). Implementing secure deployment methods (such as the NIST Secure Software Development Framework - SSDF) ensures that pipeline secrets are securely managed in systems like HashiCorp Vault, and that container configurations undergo automated security scanning before being shipped to production environments.