1 min read

Graceful shutdown is a product feature

What a 15-second drain window buys you, and why SIGKILL defaults are a tax on every deploy.

  • Go
  • Reliability

SIGTERM handling is the difference between "deploy" and "deploy plus a
blip". The whole contract fits in fifteen lines of Go:

  • stop accepting new connections,
  • finish in-flight requests within a drain window (15s is plenty),
  • close idle keep-alives, exit non-zero only if you had to force it.

But the server is only half. Proxies must be told (grace periods), health
checks must agree (readiness flips before the drain starts), and your
orchestrator must actually send SIGTERM — docker stop does, docker kill
never will.

Test it like you test auth: kill -TERM the process under load in CI and
assert zero 5xx. It's a five-line test that pays for itself every deploy.