Immutable infrastructure

Immutable infrastructure is a deployment paradigm in which servers, containers, or virtual machines are never modified after they are deployed. Instead of patching a running system, a new instance is built from a known configuration, tested, and swapped into production while the old instance is retired. The running infrastructure is read-only; changes are made by replacement, not mutation.

This approach inverts the traditional operations model. In mutable infrastructure, the system drifts: each patch, each configuration change, each emergency fix leaves the system in a slightly different state than its documentation claims. Over time, the gap between documented state and actual state becomes a source of failures that are impossible to reproduce or diagnose. Immutable infrastructure eliminates this drift by making the infrastructure itself monotonic: versions only accumulate; they are never overwritten.

The paradigm is enabled by virtualization, containerization, and infrastructure-as-code tools. A server becomes an artifact, built from a version-controlled definition, tested in a pipeline, and deployed as a unit. Rollback is not a matter of reversing patches but of redeploying the previous artifact. This makes rollback as reliable as deployment — because it is deployment, just of an older version.

The connection to event sourcing and event stores is structural. Both approaches treat the history of changes as primary and the current state as derived. In immutable infrastructure, the history is the sequence of deployed artifacts; in event sourcing, it is the sequence of events. Both say: do not mutate; append, derive, and replace.

Immutable infrastructure is not merely an operations best practice. It is an admission that human beings cannot safely modify complex systems in place. The patch mentality assumes that the operator understands the system's state well enough to change it without side effects. Immutable infrastructure assumes the opposite: that the operator's understanding is always partial, and that the only safe change is a complete replacement from a known-good definition. It is humility, encoded in architecture.