Docker 容器健康检查停止不健康的容器

Question

I have a docker container that has a healthcheck running every 1 min. I read that appending "|| kill 1" to the healthcheck in dockerfile can stop the container after healthcheck fails, but it does not seem to be working for me and I cannot find an example that works.

Does anybody know how I can stop the container after marked as unhealthy? I currently have this in my dockerfile:

HEALTHCHECK --start-period=30s --timeout=5s --interval=1m --retries=2 CMD bash /expressvpn/healthcheck.sh || kill 1

EDIT 1
Dockerfile

FROM debian:buster-slim

ENV CODE="code"
ENV SERVER="smart"

ARG VERSION="expressvpn_2.6.0.32-1_armhf.deb"

COPY files/ /expressvpn/

 RUN apt-get update && apt-get install -y --no-install-recommends \
expect curl ca-certificates iproute2 wget jq \
&& wget -q https://download.expressvpn.xyz/clients/linux/${VERSION} -O /expressvpn/${VERSION} \
&& dpkg -i /expressvpn/${VERSION} \
&& rm -rf /expressvpn/*.deb \
&& rm -rf /var/lib/apt/lists/* \
&& apt-get purge --autoremove -y wget \
&& rm -rf /var/log/*.log

HEALTHCHECK --start-period=30s --timeout=5s --interval=1m --retries=2 CMD bash /expressvpn/healthcheck.sh || exit 1

ENTRYPOINT ["/bin/bash", "/expressvpn/start.sh"]

healthcheck.sh

if [[ ! -z $DDNS ]];
then
    checkIP=$(getent hosts $DDNS | awk '{ print $1 }')
else
    checkIP=$IP
fi

if [[ ! -z $checkIP ]];
then
    ipinfo=$(curl -s -H "Authorization: Bearer $BEARER" 'ipinfo.io' | jq -r '.')
    currentIP=$(jq -r '.ip' <<< "$ipinfo")
    hostname=$(jq -r '.hostname' <<< "$ipinfo")
    if [[ $checkIP = $currentIP ]];
    then
        if [[ ! -z $HEALTHCHECK ]];
        then
            curl https://hc-ping.com/$HEALTHCHECK/fail
            expressvpn disconnect
            expressvpn connect $SERVER
            exit 1
        else
            expressvpn disconnect
            expressvpn connect $SERVER
            exit 1
       fi
    else
        if [[ ! -z $HOSTNAME_PART && ! -z $hostname && $hostname != *"$HOSTNAME_PART"* ]];
        then
            #THIS IS WHERE THE CONTAINER SHOULD STOP <------------
            kill 1
        fi

        if [[ ! -z $HEALTHCHECK ]];
        then
            curl https://hc-ping.com/$HEALTHCHECK
            exit 0
        else
            exit 0
        fi
    fi
else
    exit 0
fi

start.sh

#!/usr/bin/bash
cp /etc/resolv.conf /etc/resolv.conf.bak
umount /etc/resolv.conf
cp /etc/resolv.conf.bak /etc/resolv.conf
rm /etc/resolv.conf.bak
service expressvpn restart
expect /expressvpn/activate.sh
expressvpn connect $SERVER

touch /var/log/temp.log
tail -f /var/log/temp.log

exec "$@"

Answer 1

Try Changing from kill to exit 1

HEALTHCHECK --start-period=30s --timeout=5s --interval=1m --retries=2 \
CMD bash /expressvpn/healthcheck.sh || exit 1

Reference from docker docs

Edit 1:

After some testing if you want to kill the container on unhealthy status you need to do it in the health check script /expressvpn/healthcheck.sh or by script on the host.

The following example the container status is healthy:

HEALTHCHECK --start-period=30s --timeout=5s --interval=10s --retries=2 CMD bash -c 'echo "0" || kill 1' || exit 1

The following example the container stops since the command ech not exit then the kill 1 is executed and the container got killed:

HEALTHCHECK --start-period=30s --timeout=5s --interval=10s --retries=2 CMD bash -c 'ech "0" || kill 1' || exit 1

Edit 2:

Well after a bit of digging i understood something that i saw in some dockerfiles:

RUN apt update -y && apt install tini -y

ENTRYPOINT ["tini", "--"]
CMD ["./echo.sh"]

From what i got docker keeps the pid 1 = entrypoint process from getting killed by SIGTERM so for this you have tini small util that helps with this (still not sure what exactly the purpose of this i will keep it for next time i will be in the mood..).
Anyway after adding tini the container got killed with kill 1

Thank you for the question.

Answer 2

please check the output of your health check. You'll have to ensure that your healthcheck actually fails 2 consecutive times.

 docker inspect --format "{{json.State.Health }}" <container name> | jq