Progressive Delivery: Rolling Out Changes Without Rolling the Dice
Feature flags and canary releases both claim to reduce risk. Combined correctly, they compound.
Progressive delivery is often reduced to “use feature flags,” but the pattern is really about decoupling two separate risks: shipping code and exposing behavior.
Two different kinds of risk
A canary release manages infrastructure risk — does the new binary behave under real traffic. A feature flag manages product risk — does the new behavior work for users. Conflating the two means a bad flag decision gets blamed on the deploy pipeline, and vice versa.
- Canary releases should roll back automatically on infrastructure signals: error rate, latency, saturation.
- Feature flags should roll back on product signals: conversion, engagement, support tickets.
- Mixing the two rollback triggers is the most common reason progressive delivery still causes incidents.
The practical fix
Keep the two systems separate, even if they share a UI. A deploy that is 100% rolled out with a flag at 1% is a completely different risk profile than a deploy at 10% with a flag at 100%, and your tooling should make that distinction visible.