Metadata

Id: dockercompose-healthcheck-disabled

Platform: DockerCompose

Severity: Medium

Category: Availability

Learn More

• Provider Reference

Description

Explicitly disabling a container healthcheck removes the ability for orchestrators and monitoring tools to detect and recover from unhealthy service states, reducing availability and observability. A service’s healthcheck block should not set disable: true or test: ["NONE"], both of which suppress all health monitoring. A scalar test: "NONE" is a CMD-SHELL command, not a disable directive, and is not flagged. Services that inherit a healthcheck from their image are not affected; only explicit suppression is detected by this rule.

Compliant Code Examples

services:
  inherited:
    image: alpine
  enabled:
    image: alpine
    healthcheck:
      test: [CMD, wget, --spider, http://localhost]
  scalar_none_is_cmd_shell:
    image: alpine
    healthcheck:
      test: "NONE"

Non-Compliant Code Examples

services:
  disabled:
    image: alpine
    healthcheck:
      disable: true
  none_test:
    image: alpine
    healthcheck:
      test: [NONE]