✅ Health check in Docker

[drifting nest]

How do you set up a health check in Docker for Directus?

Based on https://docs.directus.io/reference/system/server.html#health, my idea was:

    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8055/server/health"]

But it fails with the following error, which can be seen by running docker inspect directus-directus-1 | jq '.[].State.Health':

OCI runtime exec failed: exec failed: unable to start container process: exec: \"curl\": executable file not found in $PATH: unknown

Seems there is no curl in the image. That's fine. Instead, we can use wget:

wget --no-verbose --tries=1 --spider 'http://localhost:8055/server/health' || exit 1

Kind of a self-answer. Though, I found opinions that using curl etc. for healthcheck have disadvantages, and it is proposed to have a custom healthcheck built into the app:

• https://www.paulsblog.dev/how-to-successfully-implement-a-healthcheck-in-docker-compose/#6-a-custom-health-check
• https://blog.sixeyed.com/docker-healthchecks-why-not-to-use-curl-or-iwr/

What do respected maintainers and community think about it?
For example, Traefik has a dedicated CLI command: https://doc.traefik.io/traefik/operations/cli/#healthcheck

[finite timber]

Thanks for posting! This is a community powered server, so you may or may not get an answer based on available help and expertise. To increase your chances of somebody being able to help you, please help us help you making sure you:

• Adding an explanation of exactly what you're trying to achieve.
• Adding any and all related code or previous attempts.
• Describing the exact issue or error you are facing.
• Posting any screenshots if applicable.
• Reading through https://stackoverflow.com/help/how-to-ask.

When you're done with this thread, please close it. Thanks! ✨

(If you have a support agreement and need help, please contact the core team via email.)

[abstract bloom]

I'm a little confused by the question tbh.

Doesnt: yourip/server/health not work for you?

Works fine for my on my clustered docker instance with no other options.

Are you talking about creating a cli command for calling that command?

You could setup a free uptimerobot account and have it check the server/health endpoint.

Doesnt have to be public facing and they have free android/ios apps

[drifting nest]

I'm specifically talking about the Docker's healthcheck feature: https://docs.docker.com/compose/compose-file/05-services/#healthcheck

[abstract bloom]

oh ok. checking

I can see how this can be helpful internally

[drifting nest]

The URL works fine, sure. And I've managed to have it work with wget instead of curl. The question / thought is about a more robust way of using it in Docker.

[abstract bloom]

Understood. 🙂 I deploy using DO apps so I cant say much on the topic. Thanks for the clarification

[arctic blade]

you can implement a custom endpoint with just a few lines of code and get all you need, you can frequently ping it with the docker tool

[drifting nest]

Do you mean https://docs.directus.io/extensions/endpoints.html?
If so, then this is of no help, because Directus already has an endpoint for health check. The discussion is about how to call it from CLI. Specifically, that using curl, wget etc. is supposedly discouraged, yet it works.

[arctic blade]

don't used the healthcheck thing of docker, but it looks like it calling the url automatically using curl, so no need for any cli? or did i miss something?

[drifting nest]

No, its directive expects a CLI command. https://docs.docker.com/compose/compose-file/05-services/#healthcheck

[arctic blade]

still not getting the point. From what I read, the response status code is evaluated, so if the already build on endpoint returns you a 2xx docker will assume is still healthy. if not returnign a success code, it will be set as unhealthy. What else do you want to achieve?

who said, "curl or wget is supposedly discouraged"?

[iron eagle]

There is a server health endpoint

you can find it in the docs > endpoints

[arctic blade]

that not the point 😄 it's about how to call it

[iron eagle]

Not sure if thats what your looking for tho, but it will return warn/ok/error if im correct, if you pass an admin token, it will give more data like db response time ect

[arctic blade]

Docker will just check the status code soooo no need for more details 😄

[iron eagle]

Ah alright, then im not sure

I always use an external service for monitoring

[arctic blade]

would also refer to an external (paid) service for critical apps, as you are lost if the docker service or the whole host it self becomes unhealthy

[abstract bloom]

same

[arctic blade]

Using a Flow could also be used to track the health of another Direcuts app (I've made this already 🤓 )

[iron eagle]

True but no thanks

Most monitor services have sms&email and stats tracking built in

Ofc it can be done with flows but i prefer something simple/out of my control

[drifting nest]

This is all right. It works. With one remark that it's not Docker who pings the HTTP endpoint but the wget, which is specified in the health check command. Docker needs a command to run, it's up to developer which util to use.

[drifting nest]

Links to the articles are there in the end of my original post. However, I think it's not about “who” but about “what” they say. The main argument is:

But keep in mind that if you add curl or wget you could also add all the attack surfaces of those two tools.

In Directus image, curl is not there, but wget is there.

Though, the question is whether you think that having a custom CLI command for health check would be worth adding it, keeping the above mentioned argument in mind.

[drifting nest]

External monitoring has a different goal. Docker’s health check is aimed at container auto-healing, not at notifying.

From https://codeblog.dotsandbrackets.com/docker-health-check/:

When the test fails few times in a row, problematic container will get into “unhealthy” state, which makes no difference in standalone mode (except for triggered health_status event), but causes container to restart in Swarm mode.

More at https://serverfault.com/q/890948.

[abstract bloom]

I see what you are saying. I think not much thought has been given to the docker healthcheck since most prod deployments are some variant of k8 which can use http/tcp as the healthcheck for unhealthy container.

I can see how this could be an issue when running your own servers and not using a service.

[drifting nest]

Anyhow, it's a minor issue. Just food for thought.

[finite timber]

✅ Health check in Docker