Currently, rebooting/upgrading the instance sends a TERM signal to all
running services, waits 1 second and then reboots. Processes that take
longer to cleanly stop can't do so.
Instead, give each service up to 15s to do a clean shutdown. Reboot 15s
after the command is sent, or after all services are stopped, whichever
comes first.
To make it easier to kill entire process tree for a service, create a
per-service process group. Stopping the service can be done by sending a
single signal to the process group.