Four hundred containers upgrade, each with its own undo

Four hundred customer containers need the new runtime. The agent upgrades them the way an SRE would if an SRE had the patience: one at a time, each step reversible.

Per container: snapshot with expiry: 7, run the upgrade, hit that customer's health URL, read the response. Green: next container. Red: restore the snapshot: that customer is back on the old runtime in one call: log the failure, keep rolling. By morning, 396 upgraded, 4 restored and flagged, zero customers down.

Orchestrators gate rollouts on health checks too, but rollback there means redeploying an image and hoping the state survived. Here rollback is the container's own disk, one PUT away, per customer.

No single customer can turn into an outage.