small set of instances that get the new build first.
For a period of time, instances running the new build coexist with instances running the old build
If the canary instances behave oddly, or their metrics go south, then the build is not rolled out to the remaining population
todo: ref handling versions - peaceful side-by side running of different versions
(src: Book: release it! - Michael Nygard)