Immutable infrastructure for web workloads

Overview

Immutable means you replace instances instead of patching in place—containers, VM scale sets with new images, or static sites behind CDN. It reduces drift and speeds rollback.

Patterns

• Container registry with signed images; CI builds new tags per release; orchestrator rolls out gradually.
• Golden AMIs / Azure Shared Image Gallery versioned quarterly with security baseline baked in.
• Infrastructure tests in pipeline: CIS checks, CVE gates on base image age.

Client benefits

Predictable deployments, audit trail from Git, easier disaster recovery (redeploy from known artifact).

Caveats

Stateful tiers still need backup/restore discipline; “immutable” does not delete the need for secrets rotation or database patching on PaaS.

MSP note

Document who owns image CVE SLAs—platform team vs app team—to avoid ticket tennis.