5.27 Ensure that container health is checked at runtime

Information

If the container image does not have an HEALTHCHECK instruction defined, you should use the --health-cmd parameter at container runtime to check container health.

Rationale:

If the container image you are using does not have a pre-defined HEALTHCHECK instruction, use the --health-cmd parameter to check container health at runtime.

Based on the reported health status, remedial actions can be taken if necessary.

Impact:

None.

Solution

You should run the container using the --health-cmd parameter.
For example:

docker run -d --health-cmd='stat /etc/passwd || exit 1' nginx

Default Value:

By default, health checks are not carried out at container runtime.

See Also

https://workbench.cisecurity.org/files/4532

Item Details

Category: SYSTEM AND INFORMATION INTEGRITY

References: 800-53|SI-16, CSCv7|3.1

Plugin: Unix

Control ID: 33f973f6a9da8b4df7c5f32fe1cf62a44b3c99a93a31c437eadb37f898323294