Control: 4.6 Ensure that HEALTHCHECK instructions have been added to container images
Description
You should add the HEALTHCHECK instruction to your Docker container images in order to ensure that health checks are executed against running containers.
An important security control is that of availability. Adding the HEALTHCHECK instruction to your container image ensures that the Docker engine periodically checks the running container instances against that instruction to ensure that containers are still operational.
Based on the results of the health check, the Docker engine could terminate containers which are not responding correctly, and instantiate new ones.
Remediation
You should follow the Docker documentation and rebuild your container images to include the HEALTHCHECK instruction.
Default Value
By default, HEALTHCHECK is not set.
Usage
Run the control in your terminal:
powerpipe control run docker_compliance.control.cis_v160_4_6Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run docker_compliance.control.cis_v160_4_6 --shareSQL
This control uses a named query:
select id as resource, case when config -> 'Healthcheck' is null then 'alarm' else 'ok' end as status, (names ->> 0) || case when config -> 'Healthcheck' is null then ' health check configured.' else ' health check not configured.' end as reason , _ctx ->> 'connection_name' as connection_namefrom docker_container;