Platform Deploy Best Practices

A condensed summary of the 25 most important platform deploy practices for Node.js teams - drawn from every page in this section.

How to Use This List

Maintain a staging environment that mirrors production topology
Run quarterly game days: rollout + rollback drill on production-like cluster
Pair with Runtime Ops Best Practices for SIGTERM and on-call

12-factor config: Env vars + Zod parse at boot - Platform Deploy Basics.
NODE_ENV=production in orchestrator: Not only in Dockerfile.
Bind 0.0.0.0 and PORT: Required for containers.
One process per container: No PM2 inside K8s pods.
Stateless replicas: Sessions and uploads in Redis/S3, not pod disk.
Logs to stdout JSON: No file appenders in container.
Immutable image tags: Deploy SHA from CI - CI/CD Best Practices.
Release phase for migrations: Job/initContainer before Deployment rollout.
/health liveness, /ready readiness: DB on ready only - Health & Readiness Probes.
Non-root UID 1000: Matches Docker USER node.
Resource requests from load tests: Not copy-paste defaults - HPA & Resource Limits.
Memory limit headroom: 1.5-2x RSS p99 for Node GC spikes.
HPA minReplicas ≥ 2: HA for node drains.
PDB minAvailable: Protect during cluster upgrades.
Rolling maxUnavailable: 0: No capacity dip during deploy - Zero-Downtime Deploys.
preStop sleep + SIGTERM handler: Drain in-flight HTTP.
ConfigMap for non-secrets, Secret for credentials: - ConfigMaps & Secrets.
External Secrets for rotation: SSM/Vault sync into cluster.
Never log secret env values: Redact in serializers.
Ingress TLS termination: cert-manager or cloud LB certs.
Separate worker Deployment: Scale queue consumers independently.
Document platform choice ADR: K8s vs ECS vs Cloud Run with revisit date.
Smoke test after every deploy: /health + one business flow.
Rollback = previous image SHA: Under 15 minutes documented.
Dev/prod parity: Same Node 24 image locally via compose and in prod.

FAQs

What is the single highest-impact platform practice?

Validate all configuration at boot with a single Zod module and fail the pod if invalid. Prevents half-configured production traffic.

Kubernetes or Fargate for a team of five?

Fargate or Cloud Run if AWS/GCP native and one to three services. K8s when multiple teams share a platform or need operators.

Where do feature flags live?

Non-sensitive toggles in ConfigMap env. Product flags in a dedicated service (LaunchDarkly) when dynamic targeting is required.

How many environments?

Minimum: dev, staging, production. Previews optional per PR - Preview Environments.

GitOps or pipeline kubectl?

GitOps (Argo/Flux) for audit trail; pipeline kubectl acceptable for small teams with discipline.

Platform Deploy Basics - 12-factor intro
Kubernetes Deployment - manifests
ECS Fargate & Cloud Run - managed paths
Graceful Shutdown - SIGTERM
Docker Best Practices - image checklist

Stack versions: This page was written for Node.js 24.18.0 (Active LTS), npm 10+, TypeScript 5.6+, Express 5, Fastify 5, and NestJS 11.

How to Use This List

Maintain a staging environment that mirrors production topology

Run quarterly game days: rollout + rollback drill on production-like cluster

Pair with Runtime Ops Best Practices for SIGTERM and on-call

12-factor config: Env vars + Zod parse at boot - Platform Deploy Basics.

NODE_ENV=production in orchestrator: Not only in Dockerfile.

Bind 0.0.0.0 and PORT: Required for containers.

One process per container: No PM2 inside K8s pods.

Stateless replicas: Sessions and uploads in Redis/S3, not pod disk.

Logs to stdout JSON: No file appenders in container.

Immutable image tags: Deploy SHA from CI - CI/CD Best Practices.

Release phase for migrations: Job/initContainer before Deployment rollout.

/health liveness, /ready readiness: DB on ready only - Health & Readiness Probes.

Non-root UID 1000: Matches Docker USER node.

Resource requests from load tests: Not copy-paste defaults - HPA & Resource Limits.

Memory limit headroom: 1.5-2x RSS p99 for Node GC spikes.

HPA minReplicas ≥ 2: HA for node drains.

PDB minAvailable: Protect during cluster upgrades.

Rolling maxUnavailable: 0: No capacity dip during deploy - Zero-Downtime Deploys.

preStop sleep + SIGTERM handler: Drain in-flight HTTP.

ConfigMap for non-secrets, Secret for credentials: - ConfigMaps & Secrets.

External Secrets for rotation: SSM/Vault sync into cluster.

Never log secret env values: Redact in serializers.

Ingress TLS termination: cert-manager or cloud LB certs.

Separate worker Deployment: Scale queue consumers independently.

Document platform choice ADR: K8s vs ECS vs Cloud Run with revisit date.

Smoke test after every deploy: /health + one business flow.

Rollback = previous image SHA: Under 15 minutes documented.

Dev/prod parity: Same Node 24 image locally via compose and in prod.

FAQs

What is the single highest-impact platform practice?

Validate all configuration at boot with a single Zod module and fail the pod if invalid. Prevents half-configured production traffic.

Kubernetes or Fargate for a team of five?

Fargate or Cloud Run if AWS/GCP native and one to three services. K8s when multiple teams share a platform or need operators.

Where do feature flags live?

Non-sensitive toggles in ConfigMap env. Product flags in a dedicated service (LaunchDarkly) when dynamic targeting is required.

How many environments?

Minimum: dev, staging, production. Previews optional per PR - Preview Environments.

GitOps or pipeline kubectl?

GitOps (Argo/Flux) for audit trail; pipeline kubectl acceptable for small teams with discipline.

Stack versions: This page was written for Node.js 24.18.0 (Active LTS), npm 10+, TypeScript 5.6+, Express 5, Fastify 5, and NestJS 11.

Platform Deploy Best Practices

How to Use This List

FAQs

Related

Buscar en la documentación

Platform Deploy Best Practices

How to Use This List

FAQs

Related