How do you deploy a hotfix during a multi-stage canary release?

What's really being asked

This question tests whether you understand Progressive Delivery as a practice that builds upon CI/CD to provide safeguards and control levers. The interviewer wants to see that you treat canary launches and percentage rollouts as mechanisms that decouple deploy from release, so a patch does not have to destroy an ongoing gradual rollout.

The full answer

A strong answer hits four things in order. First, acknowledge that the current canary cohort is already receiving the new code and that breaking that subset would defeat the purpose of a controlled rollout. Second, state that the hotfix should be wrapped in a separate feature flag or delivered as a dark launch so the patch can be toggled independently of the original release. Third, explain that the fix is exposed only to the existing canary cohort first, preserving the current percentage rollout and allowing the same testing in production to continue. Fourth, note that once you confirm the patch does not cause errors in production, both changes are jointly advanced through percentage rollouts or ring deployments rather than restarting the cycle.

The mistakes people make

The biggest red flag is suggesting a full rollback of the entire release or halting traffic to the canary cohort. That conflates deployment with release and breaks the Progressive Delivery model. Another weak pattern is proposing to patch the code in place and restart all instances, which ignores the subset logic of canary launches and ring deployments. Saying you would wait for the canary to finish before fixing the vulnerability is also unacceptable because it leaves users exposed to errors in production.

What usually comes next

The interviewer may ask how you would handle a hotfix that touches the same code paths under canary observation, or how you maintain isolation when two feature flags interact. They might also ask what you do if the hotfix itself fails in the canary cohort, or how you communicate status while the release is in a partially rolled-out state.

A concrete example

Imagine you are running a percentage rollout to five percent of users and a flaw is found in the new feature. Instead of reverting, you build the patch and wrap it in a new feature flag. You deploy the patched binary behind that flag to the same five percent cohort, keeping the original flag on. Because you are using dark launch semantics, the rest of the user base sees neither the original feature nor the patch. After confirming the patch does not introduce errors in production, you begin expanding the ring deployment to twenty percent, carrying both changes together under the Progressive Delivery model.