Zero-Downtime Database Migration Program Playbook
A program for migrating a production database engine or version with zero downtime using expand-and-contract: CDC replication, dual-write, shadow reads, and a staged, reversible cutover behind feature flags.
Some databases simply cannot go offline. For systems with strict availability requirements, a maintenance-window migration is not acceptable, so the migration must happen live, with traffic flowing the entire time. This playbook runs a zero-downtime database migration using dual-write, change-data-capture replication, shadow reads, and a staged, reversible cutover.
The guiding principle is the expand-and-contract pattern: add the new path alongside the old, run both in parallel while validating, then remove the old path only after the new one is proven. Every step must be reversible until the final contract.
Phase-by-Phase
Planning and Compatibility. Assess schema and behavioral compatibility, choose a cutover strategy, and define explicit rollback criteria before touching production.
Replication and Dual-Write. Set up CDC replication from source to target, optionally add an application dual-write layer, and continuously verify that the two databases stay in sync.
Shadow Reads and Validation. Send read traffic to the target in shadow mode, compare results against the source without serving them, and load-test the target under realistic conditions.
Staged Cutover. Shift read traffic gradually behind feature flags, promote the target to primary for writes, and decommission the source only after a stabilization window. Keep rollback ready until the very end.
Team and Roles
A migration architect owns the cutover strategy and reversibility. DBAs handle replication and promotion. Data engineers build sync and verification. SREs manage traffic shifting and incident response. Backend engineers implement dual-write and feature flags.
Risks and Mitigations
Dual-write bugs, replication lag, consistency, and rollback complexity are the major risks. Mitigate with CDC over application dual-write where possible, continuous reconciliation, shadow reads before any cutover, and feature-flagged, gradual traffic shifting.
Success Criteria
The non-negotiable criteria are zero downtime and zero data loss, plus verified data parity and demonstrated rollback readiness at every stage.
Tooling
Use CDC and replication tooling feeding an event backbone, feature flags for traffic control, caching for read offload, and CI for orchestration. Continuous comparison tooling validates source and target throughout.