Walk me through the difference between blue green and canary deployments, and when you would pick each.

Blue green runs two complete environments and cuts traffic over at once, so rollback is instant but every user meets the new version at the same moment. Canary sends a small slice of real traffic to the new version and grows it while you watch SLIs, so the blast radius is small but the rollout is slower. Pick blue green for fast, schema neutral cutovers; pick canary for risky logic changes at scale.

Blue green is two full stacks with a switch in front. You deploy to the idle one, verify, flip the router, and if it goes wrong you flip back in seconds. Canary is progressive: 1% of traffic, then 5, then 25, watching error rate and latency at each step, with an automated rollback if the new version looks worse than the baseline. I lean canary for anything where the risk is subtle behavior change, because blue green only tells you about breakage after everyone is on it. Blue green is great for infrastructure level swaps where the code is unchanged. The thing that dominates both is the database. We ran expand and contract on every schema change, so the new column ships first, both versions can read and write, and only after the old version is fully retired do we drop anything. Without that, your instant rollback is not actually available, which is a nasty thing to discover mid incident.