wick-zero-downtime-upgrade

Upgrading wick without downtime

Wick can replace its own binary while it is serving: a successor process starts, inherits the listening socket, and the old process keeps working until it is finished. The port is never closed, so nothing in front of wick (nginx, a load balancer, a browser) ever sees a refused connection.

That is reload. It is not the same as restart, and the difference is the whole point:

• restart — stop, then start. The port is closed for the successor's entire boot (tens of seconds on a loaded host: registry restore, database, connectors), so requests fail for that window, and every in-flight agent turn, workflow run and cron job is killed mid-work.
• reload — the successor boots while the old process keeps serving, takes over the socket when it is ready, and only then does the old one wind down.

Turning it on

Graceful upgrade is opt-in, because it changes how the process exits:

WICK_GRACEFUL_UPGRADE=1

Without it, SIGHUP is logged and ignored (better than Go's default, which is to terminate), and reload tells you to use restart instead.

Supported where descriptor passing exists — Linux, macOS, BSD — running as a plain daemon or under a service manager. On Windows, and when wick runs inside the tray's in-process supervisor, there is no way to hand a socket to another process: the upgrader degrades to a normal listener and you get the classic stop/start. Nothing needs a build tag or a different command; the same reload just reports that it is unavailable.

Under systemd

A handover means the process systemd forked exits while a different process keeps serving. systemd has to be told to follow the new one, or it treats the parent's exit as the service dying and kills the whole cgroup — taking the fresh process with it. Four lines do that:

[Service]
Type=notify
NotifyAccess=all
TimeoutStartSec=infinity
ExecStart=/usr/bin/<app> all
ExecReload=/bin/kill -HUP $MAINPID
Environment="WICK_GRACEFUL_UPGRADE=1"