What is graceful shutdown in Spring Boot, and why does it matter for zero-downtime deployments?

During a normal deployment (a rolling update) or an autoscaling scale-down event, a container orchestrator (Kubernetes, ECS, etc.) routinely sends a termination signal (SIGTERM) to application instances that are still actively handling requests — this isn't an error scenario, it's completely routine operational behavior.

Without graceful shutdown, the application process might terminate abruptly the moment it receives that signal — abandoning any in-flight requests mid-processing, which clients experience as a connection reset or an unexpected error, even though nothing was actually "wrong" with the application from a health perspective.

Graceful shutdown changes this behavior: on receiving a termination signal, the application:

1. Immediately stops accepting new requests (or the load balancer/orchestrator stops routing new traffic to it, ideally slightly before the shutdown signal even arrives, via a readiness-probe-driven traffic drain).
2. Allows in-flight requests a bounded grace period to finish naturally.
3. Only then actually shuts down — either once all in-flight requests complete, or once the configured grace period elapses, whichever comes first (to guarantee the process doesn't hang indefinitely on a stuck request).

Enabling it in Spring Boot:

server.shutdown=graceful
spring.lifecycle.timeout-per-shutdown-phase=30s

With this enabled, a SIGTERM triggers Spring Boot's embedded web server to stop accepting new connections but let existing ones drain, up to the configured timeout, before the JVM actually exits.

Why this matters specifically for zero-downtime rolling deployments: a rolling deployment continuously replaces old instances with new ones while traffic keeps flowing — if outgoing instances abruptly drop in-flight requests the moment they're told to terminate, users experience a steady trickle of failed requests throughout every single deployment, even though the overall system was never actually "down." Graceful shutdown, combined with the orchestrator giving the readiness probe a chance to fail first (so no new traffic gets routed to a terminating instance) and an appropriately generous termination grace period (matching or exceeding the application's configured shutdown timeout), is what actually makes a rolling deployment or autoscaling event invisible to end users rather than a source of a small but real error rate on every release.