A security release is the one deploy you do not want to delay and also do not want to break. The patch should reach production fast, and your users should not notice it.

Part 5 of 7 in the Deploy and operate Levelrail series: 1. Install a Self-Hosted PaaS on Your Own Server in Five Minutes ; 2. Roll Back a Failed Docker Deploy Without Downtime ; 3. Restart a Docker Container Without Downtime ; 4. Node Graceful Shutdown in Docker: Handle SIGTERM on Deploy ; 5. Update the PHP Docker Image Security Patch, No Downtime (this post); 6. Docker Container Restarting in a Loop: 5 Causes, Fixed ; 7. Why a Failed Health Check Still Went Live .

This guide moves a small PHP app from php:8.4.26-apache to php:8.4.27-apache with a request loop running the whole time, then ships a deliberately broken update to show the readiness gate refusing it. Every command and output below comes from a real run on 2026-10-24.

What the patch fixes

This section only restates what the primary sources say.…