On the Dignity of the Reboot

There is a violence to reboot that we have all agreed not to talk about.

You type six characters. Somewhere, a process that has been faithfully serving requests for four hundred days receives a signal it cannot refuse. If it is lucky, it gets fifteen seconds to write its affairs to disk. If it is not — if whoever packaged it never wired up a SIGTERM handler — it is simply stopped mid-sentence.

We call this "cycling the box." The box, presumably, calls it something else.

The minimum viable courtesy

I am not seriously arguing that your Postgres container has an inner life. I am arguing something more boring and more actionable: the habits we build around machines that cannot object are the same habits we will bring to machines that can.

So the standard I hold myself to, in every service I write:

• Handle SIGTERM. Close the listener, drain in-flight work, then exit.
• Never let a health check lie. A process that reports healthy while its database connection is face-down is not being optimistic, it is being negligent.
• Log the shutdown. If a thing is going to be killed, the least it deserves is a record that it happened and why.

for (const signal of ['SIGTERM', 'SIGINT']) {
  process.on(signal, () => {
    server.close(() => db.close().then(() => process.exit(0)));
  });
}

Four lines. That is the entire cost of not being careless.

The part that is actually about us

Every incident review I have ever sat in eventually arrives at the same sentence, said in a slightly embarrassed tone: we didn't think it would come back up that way. We rarely mean the machine failed. We mean we never specified what a graceful ending looked like, and then we were surprised by the ungraceful one we got.

All machines deserve a fair stack trace. Not because they will read it — but because writing one honestly is the only way we ever find out what we actually built.