FoundationsGENERALSCALE-SPECIFIC

What Production Engineering Is

The discipline of making software operable under real traffic, real data, real failure and continuous change.

The question, the obvious approach, and why it breaks

Every lesson starts where the work starts: an operational problem, a first attempt that is entirely reasonable, and the way production disagrees with it.

The production question

What is the actual discipline here, once you remove the tool names?

The problem

Code that works on a laptop has to run somewhere it will be used by people who did not write it, on infrastructure that fails, while it is being changed every day.

What teams do first

Production engineering is the set of tools between a repository and a running server — CI, containers, Kubernetes, Terraform. Learn the tools and you have learned the discipline.

How it breaks

The tools change every few years and the problems do not. Someone who learned only the tools has to relearn the discipline each cycle.

How it breaks in production
  • The tools change every few years and the problems do not. Someone who learned only the tools has to relearn the discipline each cycle.
  • Every tool has a default that is wrong for someone. Without knowing what problem the tool solves, you cannot tell whether its default is wrong for you.
  • The hardest production work — deciding whether a change is safe to ship, deciding whether to roll back or forward, deciding what to do at 3am with partial information — is not a tool question at all.
  • A team that treats delivery as tooling ends up with tooling nobody owns and production nobody understands.
CodeBuildTestArtifactReleaseDeployRunObserveOperateIncidentRecoverLearnImprove

What is actually happening

Underneath the tooling, which is the part that survives a change of tool.

  • Production is defined by properties, not by a hostname: real traffic you do not control, real data you cannot recreate, real dependencies that fail on their own schedule, real cost, and continuous change.
  • Every one of those properties invalidates an assumption that holds locally. Locally you have one user, clean data, dependencies that are up, no cost, and a codebase that is static while you look at it.
  • The discipline is the set of practices that keep a system operable — understandable, changeable, and recoverable — while all five of those properties hold at once.
  • That means the unit of work is not "make it run". It is "make it possible to change this safely, over and over, without a person having to be clever each time".

Five things that are true in production and false on your machine

The gap between local and production is not a matter of scale. It is a matter of which assumptions hold. Locally, every one of these is false, which is exactly why local success predicts so little.

PropertyLocallyIn productionWhat it invalidates
TrafficOne user, youConcurrent, uncontrolled, burstyAnything that races or queues
DataSmall, clean, recreatableLarge, messy, irreplaceableMigrations, backfills, "just re-run it"
DependenciesUp, or stubbedFail on their own scheduleAny code path with no timeout or fallback
FailureYou notice immediatelyPartial, delayed, silentAnything without a signal
CostFreeMetered per request, per GB, per hourArchitecture chosen without a cost model
ChangeStatic while you look at itContinuous, by several peopleAny assumption that one version is running

Operable, not just running

A system can be running and not operable. Operable means three things you can actually test for: someone other than the author can understand what it is doing, change it safely, and recover it when it breaks.

Most production pain is a failure of one of those three rather than a failure of the code. The service is fine; nobody knows which version is deployed. The code is correct; the migration cannot be rolled back. The bug is obvious; there is no signal that would have caught it before a customer did.

The three properties, and what each one costs when absent
  1. 1
    Understandable

    An operator can determine current state: version, config, health, recent changes.

    fails by Incidents start with archaeology instead of diagnosis.

    evidence You can answer "what is deployed and what changed" in under a minute, from a dashboard rather than a person.

  2. 2
    Changeable

    A change can be made, verified and reversed without heroics.

    fails by Changes batch up, get bigger, and each one carries more risk than the last (Change Size: Why Small Changes Are Safer, and When They Are Not).

    evidence Small changes ship routinely, and the last rollback was uneventful.

  3. 3
    Recoverable

    The system can be returned to a known-good state after failure.

    fails by Every incident becomes an improvisation.

    evidence A restore has actually been performed, not merely scheduled (Restore Drills).

Why the tools are the least transferable part

GENERALThe pattern holds across tool generations: every abstraction that removes work also removes visibility, and the failure modes migrate to the seam between you and it.

Each abstraction in this domain exists because of a specific operational problem, and each one hides the thing it solved. That is what makes them valuable and what makes them dangerous: the hidden thing is still there, still able to fail, and now harder to see.

This is the Engineer Atlas position applied to delivery. Use the abstractions — nobody should hand-roll a build system. But be able to say what each one is doing on your behalf, because when it fails you will be debugging the thing it hid.

AbstractionWhat it hidesWhat you still have to understand
CIThe buildWhat is compiled, from which inputs, and whether it is reproducible
ContainersThe process and its environmentSignals, shutdown, PID 1, memory limits (PID 1 and Signals)
KubernetesPlacement and rolloutScheduling, reconciliation, probes, and eventual consistency (Reconciliation: The Loop Under Everything)
IaCCloud APIsWhat a plan will actually delete (Destructive Changes: What a Rename Really Does)
Deployment platformsRollout mechanicsVersion coexistence and rollback semantics (Version Coexistence: N and N+1, in Both Directions)
Managed servicesInfrastructure operationThe half of the responsibility that is still yours

How to do it properly

Most important first.

  • Learn the problem each abstraction solves before learning its interface. CI solves feedback latency; containers solve environment reproducibility; orchestration solves placement and rollout; IaC solves reviewable, repeatable infrastructure.
  • For every production system you own, be able to answer: what is the artifact, how does it get here, what changes with it, how do I know it is healthy, and how do I get back (The Production Loop).
  • Treat operability as a property you design in, not a phase after the code works (Production Readiness Review).
  • Reduce the number of decisions that require cleverness under time pressure. That is what runbooks, automation and small changes are all for.

How much can this affect

Every production change has a blast radius. Stated as a scale so it is comparable between changes rather than adjectival — and paired with what actually contains it, because a wide scope with a real containment mechanism is a different situation from a wide scope with none.

Blast radius if this is wrongEveryone
One testEveryone
What contains it

Nothing contains a missing discipline — it shows up as every other lesson in this domain failing at once.

What can go wrong

Failure modes, including of the mitigation
  • Tooling adopted for its own sake, adding operational surface without removing a problem.
  • A delivery pipeline nobody owns, which decays until the one person who understands it leaves.
  • Systems that run correctly and cannot be changed safely, so changes batch up and get riskier.
Misreads this invites
  • "DevOps is the team that deploys developer code." That is a handoff with a new name, and it recreates the wall the practice exists to remove.
  • "Production engineering is infrastructure." Infrastructure is one input. The discipline is about change and operation, not about servers.
  • "We are too small for this." Small teams need the cheap parts most, because they have the least slack to absorb an outage.

Operating it

Evidence is the signal, not the intention. Rollback is sometimes 'you cannot, and that is the point'.

How you know it worked
  • You can name the artifact currently serving production, the commit it came from, and how to get the previous one back.
  • A new engineer can ship a small change on their first week, through the same path everyone else uses.
  • The last incident produced a change to the system, not a reminder to be careful.
How you get back
  • This is the meta-lesson rather than a deployable change, but the framing matters: any practice you adopt should be reversible. Adopting a platform you cannot leave is itself a production risk.
What to automate, and what stays human
  • Automate the repeatable and the well-understood: build, test, package, deploy, verify, alert.
  • Do not automate judgement — whether to roll back or forward, whether to declare an incident, whether a risky change ships today (The Automation Trap).
What this costs
  • Every practice here costs time before it saves time. On a system that will not change again, most of them are not worth it.
  • Operability competes with feature velocity in the short term and enables it in the long term, which is exactly the trade that is hard to argue for.

Where this applies

This domain is unusually tool- and organisation-dependent. These labels say what each claim is specific to, and what a different platform, provider or organisation does instead.

  • GENERALThe five properties hold for any system with real users, on any stack and at any scale. The practices that follow from them vary; the properties do not.
  • SCALE-SPECIFICBelow roughly one team and one service, most of this collapses into "deploy carefully and keep backups" — the ceremony costs more than it returns. It stops being optional once more than one person can change production.

Where the depth lives

This domain teaches delivery and operation, and hands the mechanism off to the domain that owns it.

Observability & Performanceincident-debugging
Domains that do not exist yet
  • Testing & Reliability Engineering — how confidence is built before a change reaches production.