How to Seamlessly Upgrade Nginx from 1.16 to 1.18 with Zero Downtime

1. Verify the existing Nginx 1.16.1 process

Check that the old Nginx master and worker processes are running:

# ps aux | grep nginx
root     17440  0.0  0.0  79732  1496 ?        Ss   11:42   0:00 nginx: master process sbin/nginx
nobody   17441  0.0  0.0  80120  2212 ?        S    11:42   0:00 nginx: worker process
...

2. Compile and install Nginx 1.18.0

Download and extract the source:

wget http://nginx.org/download/nginx-1.18.0.tar.gz
mv nginx-1.18.0.tar.gz /usr/local
cd /usr/local
tar xf nginx-1.18.0.tar.gz

Obtain the configure arguments from the old version:

# sbin/nginx -V
nginx version: nginx/1.16.1
configure arguments: --prefix=/usr/local/nginx --with-http_ssl_module --with-http_v2_module --with-http_realip_module --with-http_addition_module --with-http_image_filter_module --with-http_geoip_module --with-http_gunzip_module --with-http_stub_status_module --with-http_gzip_static_module --with-pcre --with-stream --with-stream_ssl_module --with-stream_realip_module

Run ./configure with the same arguments (adjusting --prefix to the old installation path):

# ./configure --prefix=/usr/local/nginx --with-http_ssl_module --with-http_v2_module --with-http_realip_module --with-http_addition_module --with-http_image_filter_module --with-http_geoip_module --with-http_gunzip_module --with-http_stub_status_module --with-http_gzip_static_module --with-pcre --with-stream --with-stream_ssl_module --with-stream_realip_module

Build the binaries (do **not** run make install):

# make

3. Perform a zero‑downtime upgrade

3.1 Backup the old binary

# cd /usr/local/nginx/sbin
# cp nginx{,.bak}

3.2 Replace the old binary with the new one

# cp -f /usr/local/nginx-1.18.0/objs/nginx /usr/local/nginx/sbin/nginx

3.3 Switch traffic to the new workers

Send USR2 to the old master process (PID 17440 in the example) to spawn new workers: # kill -USR2 17440 Verify that both old and new master processes are present, but only the new workers accept connections.

3.4 Stop the old workers

Send WINCH to the old master to gracefully shut down its workers:

# kill -WINCH 17440

3.5 Remove the old master

When satisfied, terminate the old master with QUIT (or keep it for rollback testing).

4. Rollback procedure (if the new version fails)

4.1 Restore the old binary

# mv /usr/local/nginx/sbin/nginx.bak /usr/local/nginx/sbin/nginx

4.2 Reload the old workers

# kill -HUP 17440

4.3 Stop the new workers

# kill -USR2 21081   # stop new workers from accepting traffic
# kill -WINCH 21081  # gracefully shut down new workers

4.4 Terminate the new master

# kill -QUIT 21081

After these steps the system runs the original Nginx 1.16.1 without interruption.