A method performed on a plurality of computer processors, said method comprising: executing a distributed application on said plurality of computer processors, said distributed application being executed by a plurality of replicas of application code; said distributed application being executed on virtual machines having guest operating systems, said virtual machines being operated on host devices; grouping said plurality of replicas into update domains, said update domains being groups of said replicas; identifying an update to perform on said distributed application; identifying, using input from said distributed application, a sequence of said update domains for the update; for each of said update domains, processing a current update domain to perform said update: querying said application executing in a current update domain to determine whether said current update domain is ready for updating; when said current update domain is ready for updating, perform said update on said update domain; querying said application executing in said current update domain to determine if said update results in said application operating properly within said current update domain; said update being performed in multiple update steps, each of said multiple update steps comprising processing each of said update domains in sequence; when said update results in said application operating properly, proceeding to a next update domain in said sequence of said update domains; and when said update results in said application operating improperly, suspending said update and launching a repair process to heal the application and, after healing operations have been performed, advancing the update sequence, or alerting a human administrator, or logging the conditions and automatically attempting to revert the application code to a previous version. executing a distributed application on said plurality of computer processors, said distributed application being executed by a plurality of replicas of application code; said distributed application being executed on virtual machines having guest operating systems, said virtual machines being operated on host devices; grouping said plurality of replicas into update domains, said update domains being groups of said replicas; identifying an update to perform on said distributed application; identifying, using input from said distributed application, a sequence of said update domains for the update; for each of said update domains, processing a current update domain to perform said update: querying said application executing in a current update domain to determine whether said current update domain is ready for updating; when said current update domain is ready for updating, perform said update on said update domain; querying said application executing in said current update domain to determine if said update results in said application operating properly within said current update domain; said update being performed in multiple update steps, each of said multiple update steps comprising processing each of said update domains in sequence; when said update results in said application operating properly, proceeding to a next update domain in said sequence of said update domains; and when said update results in said application operating improperly, suspending said update and launching a repair process to heal the application and, after healing operations have been performed, advancing the update sequence, or alerting a human administrator, or logging the conditions and automatically attempting to revert the application code to a previous version. querying said application executing in a current update domain to determine whether said current update domain is ready for updating; when said current update domain is ready for updating, perform said update on said update domain; querying said application executing in said current update domain to determine if said update results in said application operating properly within said current update domain; said update being performed in multiple update steps, each of said multiple update steps comprising processing each of said update domains in sequence; when said update results in said application operating properly, proceeding to a next update domain in said sequence of said update domains; and when said update results in said application operating improperly, suspending said update and launching a repair process to heal the application and, after healing operations have been performed, advancing the update sequence, or alerting a human administrator, or logging the conditions and automatically attempting to revert the application code to a previous version. launching a repair process to heal the application and, after healing operations have been performed, advancing the update sequence, or alerting a human administrator, or logging the conditions and automatically attempting to revert the application code to a previous version.