A method performed by a computing system for updating services (A, B,..., I) hosted by machines (001, 002,..., 0016), the method comprising: generating a service list based on a topological sort of a service dependency graph, wherein the service list comprises the services ordered from a least dependent service to a most dependent service, wherein the topological sort is a linear ordering of a directed acyclic graph such that, for every directed edge, a to-vertex is ordered before a from-vertex; generating an update runbook with steps for updating the services, wherein each step indicates a target service, a machine that hosts that target service, and an action, the actions being stop, update, and start, wherein the update runbook includes a step with a stop action and a step with a start action for each service affected by an update, wherein the update runbook includes a step with an update action for each service to be updated, wherein each service is stopped in an order from the most dependent service to the least dependent service, wherein each service is started in an order from the least dependent service to the most dependent service; and executing the update runbook by: for each step with a stop action, performing a stop of the target service at the machine that hosts the target service such that each service that is dependent on the target service stops before the target service starts performing a stop; for each step with an update action, after the target service stops at the machine that hosts the target service, performing an update of the target service at the machine that hosts the service; and for each step with a stop action, performing a start of the target service at each machine that hosts the target service such that each service affected by an update that the target service depends on stops and then starts before the target service starts performing a start, wherein a service is affected by an update if that service is being updated or depends on a service that is affected by an update. generating a service list based on a topological sort of a service dependency graph, wherein the service list comprises the services ordered from a least dependent service to a most dependent service, wherein the topological sort is a linear ordering of a directed acyclic graph such that, for every directed edge, a to-vertex is ordered before a from-vertex; generating an update runbook with steps for updating the services, wherein each step indicates a target service, a machine that hosts that target service, and an action, the actions being stop, update, and start, wherein the update runbook includes a step with a stop action and a step with a start action for each service affected by an update, wherein the update runbook includes a step with an update action for each service to be updated, wherein each service is stopped in an order from the most dependent service to the least dependent service, wherein each service is started in an order from the least dependent service to the most dependent service; and executing the update runbook by: for each step with a stop action, performing a stop of the target service at the machine that hosts the target service such that each service that is dependent on the target service stops before the target service starts performing a stop; for each step with an update action, after the target service stops at the machine that hosts the target service, performing an update of the target service at the machine that hosts the service; and for each step with a stop action, performing a start of the target service at each machine that hosts the target service such that each service affected by an update that the target service depends on stops and then starts before the target service starts performing a start, for each step with a stop action, performing a stop of the target service at the machine that hosts the target service such that each service that is dependent on the target service stops before the target service starts performing a stop; for each step with an update action, after the target service stops at the machine that hosts the target service, performing an update of the target service at the machine that hosts the service; and for each step with a stop action, performing a start of the target service at each machine that hosts the target service such that each service affected by an update that the target service depends on stops and then starts before the target service starts performing a start, wherein a service is affected by an update if that service is being updated or depends on a service that is affected by an update.