A disaster recovery site or new region must run the same artifacts as primary: same image digests, same lockfile installs, same runtime. Environments built once and left alone fall behind, then fail or expose old vulnerabilities at the worst time. Give them the same pipeline and compare them on a schedule.
Why standby environments drift most
Primary changes weekly. A standby that receives updates manually, or rarely, falls behind quickly. Nobody watches it, because it carries no traffic. Then a failover happens and an old build serves customers, with older libraries and missing fixes. Or the old build cannot talk to the new database schema.
The checklist
- Same pipeline. The standby deploys from the same pipeline and same artifact store as primary, not from a copy made once.
- Same identifiers. Each region records the image digest it runs. Compare them after every release.
- Same lockfile installs. No region installs packages at start time.
- Same runtime and base image. Pin both by digest or exact version.
- Same configuration source. Differences should be limited to endpoints, keys, and scale.
- Same secrets approach, with separate values per region.
- Same scanning. The standby is scanned on the same schedule as primary.
- Same advisory response. When a fix ships, a task exists for each region.
- Regular failover rehearsal that includes a package comparison before and after.
| Area | What can differ | What must not |
|---|---|---|
| Endpoints and DNS | Yes | |
| Capacity | Yes | |
| Image digests | Must match | |
| Package versions | Must match | |
| Runtime version | Must match |
Handle region specific dependencies
Some services differ by region for good reasons, such as a regional endpoint or data residency rule. Write those exceptions down with an owner, so they are not mistaken for drift. Our list of single region dependencies you forgot to list is a good companion.
Test it, do not assume it
After every major release, run a lightweight check: export the running image identifiers per region and diff them. Add a package list diff once a month. When a rehearsal failover happens, record which version served traffic and compare it with primary.
Mistakes to avoid
- Copying primary once and forgetting the standby.
- Exempting standby from scanning because it takes no traffic.
- Letting autoscaling use an old launch template that points to an old image.
- Assuming infrastructure code drift detection also covers application packages. It does not.
Try it yourself
Click through it at your own pace, or open it full screen.
See how continuous checks keep reporting after deployment. Standby regions benefit most from that habit.
What Safeguard does here
Safeguard supports asset discovery, container image scanning, and continuous monitoring, which helps include standby environments in the same view as primary. Try the free scan at gold.safeguard.sh/scan.
Quick check
Should the DR site be scanned if it takes no traffic?
Yes. It becomes production the moment you fail over, and old vulnerabilities come with it.
How often should I compare regions?
After every release for image identifiers, and monthly for full package lists.
Last reviewed: 19 October 2026.
