support `destroy` callback

`destroy` should support a callback to allow safe shutdown in case of
SIGTERM or SIGINT