Python Application Deployment Checklist

Python Application Deployment Checklist

Python deployment has many moving parts. Use this checklist to ensure nothing is missed.

Dependencies

# Pin all dependencies with exact versions
pip freeze > requirements.txt

# Or use pip-tools for better dependency management
pip-compile requirements.in --generate-hashes

• [ ] Dependencies pinned with exact versions
• [ ] Hash verification enabled for supply chain security
• [ ] No development dependencies in production requirements
• [ ] Virtual environment created and isolated

WSGI/ASGI Server

# Gunicorn for WSGI (Flask, Django)
gunicorn --workers 4 --threads 2 --bind 0.0.0.0:8000 app:app

# Uvicorn for ASGI (FastAPI, Starlette)
uvicorn app:app --host 0.0.0.0 --port 8000 --workers 4

• [ ] Production WSGI/ASGI server configured (never use dev servers)
• [ ] Worker count matches available CPU cores
• [ ] Request timeout set to prevent hanging workers
• [ ] Worker recycling configured to handle memory leaks

Configuration

import os

class ProductionConfig:
    DEBUG = False
    SECRET_KEY = os.environ['SECRET_KEY']
    DATABASE_URL = os.environ['DATABASE_URL']
    LOG_LEVEL = os.environ.get('LOG_LEVEL', 'INFO')

• [ ] DEBUG = False in production
• [ ] All secrets loaded from environment variables
• [ ] Configuration validated on startup
• [ ] Sensitive config never logged

Database

• [ ] Migrations tested and applied
• [ ] Connection pooling configured
• [ ] Backup strategy in place
• [ ] Read replicas for heavy read loads

Monitoring

• [ ] Structured logging to stdout/stderr
• [ ] Health check endpoint implemented
• [ ] Error tracking with Bugsly for exception visibility
• [ ] APM for request/response monitoring

Security

• [ ] HTTPS enforced
• [ ] Security headers set (CSP, HSTS, X-Frame-Options)
• [ ] Rate limiting on public endpoints
• [ ] Input validation on all endpoints

Container Deployment

FROM python:3.12-slim
WORKDIR /app
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt
COPY . .
USER nobody
CMD ["gunicorn", "--bind", "0.0.0.0:8000", "app:app"]

• [ ] Non-root user in container
• [ ] Multi-stage build for smaller images
• [ ] .dockerignore excludes unnecessary files