Use rolling groups to move each machine through a complete sequence of steps before the next machine begins. Choose the machine order, send a canary first, control how many machines roll at once, and stop at the right failure boundary. The rolling deployments guide walks through the setup.

One machine out of service at a time Canary first, by tag priority Grouping never changes a step's reach Machine-by-step rollout summary Three levels of failure control
01

Keep one machine out of service at a time

A rolling group keeps related steps together for each machine. For a sequence that stops the service, deploys the package, starts the service and runs a smoke test, web01 completes all four steps before web02 begins.

The rolling window defaults to 1, keeping the rest of the fleet available while each machine is updated. Increase it for controlled batches without changing which machines each step targets.

Rolling steps                     Rolling group
stop     web01 web02 web03      web01  stop > deploy > start > smoke
deploy   web01 web02 web03      web02  stop > deploy > start > smoke
start    web01 web02 web03      web03  stop > deploy > start > smoke
smoke    web01 web02 web03
02

Canary first, and nothing widens a step's reach

Order machines by name, or by tag priority - a machine's rank is the index of the first tag it carries, and machines run in rank order and by machine name within a rank, with machines carrying none of the tags last. Turn on the barrier and every machine of one tag rank finishes before the next rank starts, so the canary goes alone all the way through the group before the fleet follows.

Members keep their own machine filters. A group's machine set is the union of the machines its members target, and on each machine only the members that target it run - the rest are recorded as not targeted. Group membership changes a rollout's structure, never a step's reach: environment scoping is untouched, and deployment-level machine include/exclude still applies ahead of everything else.

03

Know which machines are on which version

The deployment preview shows the resolved machine order, the window, the barrier, and machine by machine exactly which steps will run where. The log tree runs Group to Machine to Step, with machines not yet reached visibly queued rather than missing. Every rollout ends in a machine-by-step summary - written even when the rollout stops part-way, which is exactly when machines are left on mixed versions.

Read next: the rolling deployments guide for the settings behind each of these, Project Steps Explained for how steps target machines in the first place, and Projects and Deployment Logic for where the deployment process sits.

Rollout summary - rolling group 'web-rollout'
  Machine   stop-service   deploy-package   start-service   smoke-test
  web01     ok             ok               ok              ok
  web02     ok             failed           skipped         skipped
  web03     not run        not run          not run         not run