Or he could do it with a proper load balancing proxy such as HA Proxy. Then he would be able to take one node-instance down gracefully, update it to a newer version, and put it online again (and repeat for all other instances). Another benefit would be more fair share of the load (not every request will take the same amount of time to complete).

But this is both awkward and hard to manage! You just don't get that with HAProxy.

I'd agree that a balancing proxy is more appropriate for HA. The post mentions that this is specifically not intended as a high availability solution. It's a fairly narrow use.

Is it fairly common to forward port 80 to some higher level port, so the server can run as a non-root user?

I do it out of necessity, but have yet to play with the statistics portion of iptables.

Cool little article.

I've used this trick to forward to a Twisted Conch daemon running as a non-root user. However, I would never consider this approach for load balancing.

Why would you never consider it for load balancing?

Because first of all it's just a variation of round-robin, which doesn't take into account that different requests will take varying amounts of time.

Secondly, you can't (in an easy way) remove or add to the pool of backends.

I'm confident others will come up with more not-so-compelling reasons for using iptables for load balancing.

It's probably more common to start a service as root, bind to a port, and drop privileges.