Rule Information
Tags
dockerdockerfilehealthcheckmonitoringobservabilityorchestrationkubernetesreliabilitybest-practiceavailability
CWE References
Interactive Playground
Experiment with the vulnerable code and security rule below. Edit the code to see how the rule detects different vulnerability patterns.
pathfinder scan --ruleset docker/DOCKER-BP-022 --project .1
2
3
4
5
6
7
8
9
10
rule.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
About This Rule
Understanding the vulnerability and how it is detected
This rule detects Dockerfiles that do not include a HEALTHCHECK instruction. Health checks allow Docker, Kubernetes, and other orchestrators to monitor container health and automatically restart or replace failing containers, improving application availability and resilience.
How to Fix
Recommended remediation steps
- 1Add a HEALTHCHECK instruction to enable container health monitoring
- 2Use curl, wget, or a custom health check script
- 3Set appropriate interval, timeout, and retries for your application
References
External resources and documentation
Similar Rules
Explore related security rules for Docker
MEDIUM
Base Image Uses :latest Tag
Base image uses ':latest' tag or no tag (defaults to latest). This makes builds non-reproducible.
INFO
Deprecated MAINTAINER Instruction
MAINTAINER instruction is deprecated. Use LABEL org.opencontainers.image.authors instead.
LOW
apt-get Without --no-install-recommends
apt-get install without --no-install-recommends. This installs unnecessary packages, increasing image size and attack surface.
Frequently Asked Questions
Common questions about Missing HEALTHCHECK Instruction
HEALTHCHECK lets Docker and orchestrators like Kubernetes detect when your application is unhealthy and automatically restart or replace the container.
For web services: HEALTHCHECK CMD curl -f http://localhost:8080/health || exit 1. For non-HTTP services, use a custom script that verifies the application is responsive.
New feature
Get these findings posted directly on your GitHub pull requests
The Missing HEALTHCHECK Instruction rule runs in CI and posts inline review comments on the exact lines — no dashboard, no SARIF viewer.