mipo
Menu
ProductFeaturesArchitectureSecurityComplianceDocsGitHub
Guide

Operations: Upgrade

An evaluator-facing overview of the in-place upgrade flow and its safety model. This is not the operational procedure.

Operators: use the runbook in your release bundle

The step-by-step upgrade procedure ships with every mipo release at docs/operations/upgrade.md. That file is the authoritative reference. Follow it instead of this page.

The upgrade flow

  1. Pull the new images (does not touch running containers).
  2. Preflight gate: mipo.sh deploy runs the migrator preflight FAIL-CLOSED before any schema-writing app role is stopped and before any migration runs — DB connectivity, schema drift, disk free, app-version downgrade. Backup recency and scanner protocol compatibility are reported as informational lines only and never block the deploy (backup recency: owner decision 2026-07-08; scanner protocol compatibility: reverse-DNS R1a, 2026-09-12). (Images are pulled and the proxy is recreated first; a preflight failure leaves the app serving and the database untouched.)
  3. Quiesce: the schema-writing app roles (manager, ingest, dispatcher, maintenance) are stopped so no old writer races the migration. The proxy and database stay up.
  4. Migrate: forward-only schema migrations run with the app quiesced.
  5. Roll out: the new images start and the app comes back up.

When should you take a backup?

A deploy never wipes data by itself — it applies forward-only (additive) migrations. A fresh backup is strongly advised for the one risky case: mutating the schema of an install that already holds data — but it is a deployer judgment call, not a gate; preflight reports the backup's age without blocking.

  • In-place upgrade (new version over an existing install): Strongly advised — preflight reports the newest backup’s age but does not block the upgrade on it (owner decision 2026-07-08)
  • Fresh / Day-0 install (empty cluster): Not required — the gate auto-skips (nothing to protect)
  • Wipe and reinstall (reset --all): Not required — you are deliberately destroying data
  • Restore from a bundle: You already hold the backup
  • Force an upgrade through anyway: MIPO_DEPLOY_PREFLIGHT=0 (break-glass; logged loudly)