There are two approaches to doing graceful restarts. First — is to pass all file descriptors of connections to a new instance with their state, subscriptions and other things without client reconnection. It is not worth such work in our case. The much simplier way is to share only listening socket between instances. Then on restart we first starting to accept incoming connections with new instance. Then we can tell the old instance to stop accepting new connections and slowly disconnect (with a warning message sent) its clients. In our case it is about 15 minutes to prevent DDoS. After that old instance could normally exit.