Kind of. It's enforced by the ServiceContainer, which "dies" KILL_TIMEOUT seconds after asking the dependencies to stop. We're leaving the response to a dead container up to the application (no sys.exit in nameko code) so it's more correct to say that it *may* be forcibly stopped. I'll update the docstring accordingly.