---
title: Container images should include HEALTHCHECK instructions
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Container images should include
  HEALTHCHECK instructions
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Container images should include HEALTHCHECK instructions
Classification:complianceFramework:cis-dockerControl:4.5 
## Description{% #description %}

Images should define a HEALTHCHECK.

## Rationale{% #rationale %}

With a health check, Docker tests the containers of the image and reports those that stop working, and orchestrators can replace them.

## Audit{% #audit %}

Show the health check of the images:

```bash
docker images --quiet | xargs docker inspect --format '{{ .Id }}: Healthcheck={{ .Config.Healthcheck }}'
```

Datadog passes the rule when an image defines a health check other than `NONE`, and fails it otherwise. It judges the images that a container can name by a tag or a repository digest. It leaves out the images with neither that the classic builder keeps for each build step.

## Remediation{% #remediation %}

Add a `HEALTHCHECK` instruction to the Dockerfile and rebuild the image:

```dockerfile
HEALTHCHECK --interval=30s CMD curl -f http://localhost/ || exit 1
```

## Impact{% #impact %}

None.

## Default value{% #default-value %}

Images define a health check only when their Dockerfile does.

## References{% #references %}

1. [https://docs.docker.com/reference/dockerfile/#healthcheck](https://docs.docker.com/reference/dockerfile/#healthcheck)