Docker Health Checks

The Defense Information Systems Agency (DISA) requires a Docker health check to verify the health of applications running inside containers. This check validates that services are running and responsive, ensuring continued availability.

Game Warden recommends using a healthcheck command directly in your container image to meet this requirement.

You may use a Kubernetes Liveness Probe instead of a Docker healthcheck. To remain compliant, justify this exception in Findings.

Docker healthcheck requirements

Embed a Docker healthcheck command in your container image to verify the container's health at configured intervals. If the health check fails, Docker marks the container as unhealthy and may restart it, depending on your configuration.

Health check options in Game Warden

You can meet DISA's requirement in two ways:

1. Docker healthcheck (recommended) — Add the healthcheck instruction directly to your Dockerfile.
2. Kubernetes liveness probe (acceptable alternative) — If you use a liveness probe instead, document this in Findings:
   • In Vulnerability dropdown, select Policy N/A.
   • In Justification, enter: Using Kubernetes liveness probe.

Common implementation methods

FROM python:3.8-slim
WORKDIR /app
COPY . /app
RUN pip install --no-cache-dir -r requirements.txt

HEALTHCHECK --interval=10s --timeout=5s --start-period=15s \
  CMD curl --fail localhost:8080/health || exit 1

EXPOSE 8080
CMD ["python", "app.py"]

FROM alpine:3.12
RUN apk update && apk add --no-cache wget

HEALTHCHECK --interval=10s --timeout=5s --start-period=15s \
   CMD wget --spider http://localhost || exit 1

FROM python:3.8-slim
WORKDIR /app
COPY . /app
RUN pip install --no-cache-dir -r requirements.txt

HEALTHCHECK --interval=10s --timeout=5s --start-period=15s \
  CMD curl --fail localhost:8080/health || exit 1

EXPOSE 8080
CMD ["python", "app.py"]

FROM alpine:3.12
RUN apk update && apk add --no-cache wget

HEALTHCHECK --interval=10s --timeout=5s --start-period=15s \
   CMD wget --spider http://localhost || exit 1

apiVersion: v1
kind: Pod
metadata:
  name: my-app-pod
spec:
  containers:
  - name: my-app-container
    image: my-app-image
    livenessProbe:
      exec:
        command:
        - curl
        - localhost:8080/health
      initialDelaySeconds: 15
      periodSeconds: 10

apiVersion: v1
kind: Pod
metadata:
  name: my-app
spec:
  containers:
  - name: my-container
    image: my-image
    ports:
    -  containerPort: 80
    livenessProbe:
      httpGet:
        path: /
        port: 80
      initialDelaySeconds: 5
      periodSeconds: 5
    readinessProbe:
      httpGet:
        path: /
        port: 80
      initialDelaySeconds: 10
      periodSeconds: 5
      failureThreshold: 3

javac TheComSunNetHttpServer.java
jar -c -e TheComSunNetHttpServer -v -f TheComSunNetHttpServer.jar TheComSunNetHttpServer.class
javac HealthCheck.java
jar -c -e HealthCheck -v -f HealthCheck.jar HealthCheck.class
docker build -f Dockerfile-java . -t java-healthcheck

docker run -d -p 8080:8080 java-healthcheck
sleep 2
curl http://localhost:8080

docker ps

❯ docker ps
CONTAINER ID   IMAGE              COMMAND                   CREATED         STATUS                   PORTS                    NAMES
009a72a63438   java-healthcheck   "/usr/bin/java -jar …"   52 seconds ago  Up 51 seconds (healthy)  0.0.0.0:8080->8080/tcp   friendly_cannon

javac TheComSunNetHttpServer.java
jar -c -e TheComSunNetHttpServer -v -f TheComSunNetHttpServer.jar TheComSunNetHttpServer.class
javac HealthCheck.java
jar -c -e HealthCheck -v -f HealthCheck.jar HealthCheck.class
docker build -f Dockerfile-java . -t java-healthcheck

docker run -d -p 8080:8080 java-healthcheck
sleep 2
curl http://localhost:8080

docker ps

❯ docker ps
CONTAINER ID   IMAGE              COMMAND                   CREATED         STATUS                   PORTS                    NAMES
009a72a63438   java-healthcheck   "/usr/bin/java -jar …"   52 seconds ago  Up 51 seconds (healthy)  0.0.0.0:8080->8080/tcp   friendly_cannon

javac TheComSunNetHttpServer.java
jar -c -e TheComSunNetHttpServer -v -f TheComSunNetHttpServer.jar TheComSunNetHttpServer.class
docker build -f Dockerfile-wget . -t wget-healthcheck

docker run -d -p 8080 wget-healthcheck
sleep 2
curl http://localhost:8080

docker ps

❯ docker ps
CONTAINER ID   IMAGE             COMMAND                   CREATED         STATUS                   PORTS                    NAMES
009a72a63438   wget-healthcheck  "/usr/bin/java -jar …"   52 seconds ago  Up 51 seconds (healthy)  0.0.0.0:8080->8080/tcp   friendly_cannon

import java.io.IOException;
import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse.BodyHandlers;

public class HealthCheck {
public static void main(String[] args) throws InterruptedException, IOException {
  var client = HttpClient.newHttpClient();
  var request = HttpRequest.newBuilder()
      .uri(URI.create("http://localhost:8080/actuator/health"))
      .header("accept", "application/json")
      .build();
  var response = client.send(request, BodyHandlers.ofString());

  if (response.statusCode() != 200 || !response.body().contains("UP")) {
    throw new RuntimeException("Healthcheck failed");
  }
}
}

Docker image best practices

• Expose a health endpoint that returns 200 only when the app is actually ready (connections open, migrations done, deps reachable). This enables safe autoscaling and zero-downtime deploys.

  Example: App exposes /healthz and returns 200 only when ready:

  dockerfileCopy

  HEALTHCHECK --interval=30s --timeout=3s --start-period=10s --retries=3 \
  CMD curl -fsS http://localhost:8080/healthz || exit 1
  

• Never run processes as root inside containers.

  Example: Create unprivileged user:

  dockerfileCopy

  RUN addgroup -S app && adduser -S app -G app
  USER app
  

• Each RUN, COPY, ADD makes a layer. Combine related commands and clean caches to shrink images.

• Exclude anything not needed at runtime/build (node_modules, tests, .git, IDE files, secrets).

• Use immutable, descriptive tags (for example, 1.4.3, 2025.10.01-sha.abcd123). This makes rollbacks/audits reliable.

• Never bake API keys, tokens, or certs into layers or files. Inject via env vars/secret stores at deploy. Configure CI scanners (for example, Trivy) to fail the build when they detect secrets.

• Build artifacts in one stage, then copy only the required artifacts into the final image.

• Choose distroless, Alpine, or Chainguard images when possible, and avoid large base images unless you need them. If you only need to serve static files or a single binary, use the scratch base image (0-byte base image).

• Smaller images lead to faster pulls and a smaller attack surface.