A useful health system answers more than “is a process listening?” Liveness decides whether to restart it. Readiness decides whether to send it traffic. Post-deploy checks decide whether the release behaves correctly.
Keep checks bounded
Expose a lightweight route that can report the release identity and readiness state without leaking secrets. Liveness should avoid slow external dependencies. Readiness may check dependencies essential to serving traffic, but every check needs a short timeout so the monitor cannot create an outage.
Drain before stopping
On deployment or shutdown, remove the instance from new traffic, then send SIGTERM or SIGINT. Current Next.js guidance says the server finishes in-flight requests and pending after() callbacks; it recommends a configurable 10–30 second drain period. Align the supervisor, container, and load-balancer timeouts so a shorter outer timeout does not interrupt the drain.
Test failure paths
Verify startup failure, dependency failure, an in-flight slow response during termination, a stuck shutdown, and forced termination after the deadline. Do not catch an uncaught exception and continue serving; Node.js recommends an external monitor restart a crashed process.