Every container runtime has a default grace period between "please stop" and "you are being killed" — ten seconds in Docker's case. It is easy to read that number as a constant of the platform rather than a parameter you chose, and easier still to never measure what your own services do inside it.
Two things follow from treating it as a default instead of a budget.
The sum is what your users experience
If a restart touches six containers that each take the full grace to exit, the unavailable window is not ten seconds; it is up to a minute, plus startup. That total is the number your rollback spends, and it is the one that has to fit inside whatever tolerance the service has.
restart_cost = Σ(stop_grace_period_i + startup_i) for the containers being replaced The interesting failure is when the orchestrator's health-check timeout is smaller than that sum. The platform declares the service unhealthy mid-restart, kills it again, and the cycle repeats — a restart loop that looks like a crashing application but is really an arithmetic mismatch between two timeouts set by different people.
The grace period is per service, because drain time is
A queue consumer drains in-flight work; a stateless API does not. Giving them the same number means one of the two is either wasting seconds on every deploy or dying with work in hand. The number worth setting is measured, not inherited: take the 99th percentile of in-flight work duration and add a margin.
The shutdown path is the untested path
Nobody exercises SIGTERM handling in development, because developers kill processes with SIGKILL. So the handler is the least-tested code in the service, and the grace period is where its bugs are billed.
A cheap practice that pays for itself: on every deploy, log the time from signal received to exit. After a few weeks you know each service's real drain time, and the budget above stops being hypothetical.
What to do with it
Add the sum to the deploy budget, next to startup time, and treat it as a cost you pay on every rollback. It is not a large number. It is just a number nobody computes, which is why it shows up as an incident rather than a line item.
