Q: During rolling deployments in Kubernetes and Docker Swarm, users experience 502 Bad Gateway errors and database transactions are abruptly severed mid-flight. Logs reveal that containers take exactly 10 seconds to terminate during deployment, indicating that the applications never received `SIGTERM` and were forcibly killed by `SIGKILL` (exit code 137). You must audit the container entrypoint definitions, resolve signal swallowing in wrapper shell scripts, and implement connection draining.

Understand syntax consequences: Shell form (`ENTRYPOINT command param`) wraps the command in `/bin/sh -c`, making `/bin/sh` PID 1. Standard shells do not forward signals to child processes. Exec form (`ENTRYPOINT ["command", "param"]`) executes the binary directly as PID 1, receiving signals directly.

# Shell Form (ANTI-PATTERN - Signals Swallowed!):
ENTRYPOINT ./start-server.sh
# Linux executes: /bin/sh -c ./start-server.sh (PID 1 is /bin/sh, ignores SIGTERM!)

# Exec Form (CORRECT):
ENTRYPOINT ["./start-server.sh"]
# Linux executes start-server.sh directly as PID 1

If an entrypoint must run as a shell script to perform pre-flight checks, implement a Bash `trap` handler that catches `SIGTERM` and `SIGINT`, forwards them to the background application PID, and waits for graceful termination.

#!/usr/bin/env bash
set -e

# Pre-flight tasks
echo "Running pre-flight database migrations..."
/app/migrate

# Start application in background and capture PID
/app/web-server &
APP_PID=$!

# Trap SIGTERM and SIGINT, forwarding to background process
_term() {
  echo "Caught SIGTERM signal! Forwarding to web-server (PID: $APP_PID)..."
  kill -TERM "$APP_PID" 2>/dev/null
  wait "$APP_PID"
  echo "Application successfully terminated."
  exit 0
}

trap _term SIGTERM SIGINT

# Wait for process to finish
wait "$APP_PID"

The cleanest pattern for shell wrapper scripts is using `exec` for the final application invocation. `exec` replaces the shell process with the application binary while preserving PID 1.

#!/bin/sh
set -e
# Pre-startup checks
export DATABASE_URL=$(cat /run/secrets/db_url)

# Exec replaces the shell process entirely with the application binary
exec /app/web-server --config /etc/app.yaml

Send `SIGTERM` to the running container using `docker stop` and verify in logs that the application executes its cleanup routine and exits with status 0 before the 10-second timeout expires.

# Start container and monitor logs
docker run -d --name grace-test my-app:latest
docker logs -f grace-test &

# Issue stop command and measure termination duration
time docker stop grace-test
# Output confirms exit within 1.2 seconds with exit code 0