Add curl dependency and healthcheck to Dockerfile

[SiriosDev]

Adds a health check for the availability of the instance's web UI (and, consequently, the API, since both are served through the same port).

This is useful for allowing users to quickly assess the health of their instance from applications such as Portainer, Dockhand, and Dockge. It can also be used by reverse proxies like Traefik to expose the service only after the container has fully started.

Additionally, it enables the use of health-based depends_on conditions in Compose stacks, ensuring that dependent services start only after cd.io is fully operational.

The health check simply performs a curl request against the internal HTTP endpoint on port 5000, or the custom port configured through the existing PORT environment variable.

I noticed the existing worker-health endpoint, which would provide more comprehensive health monitoring. However, since it requires authentication, I preferred the simpler approach.

Close #1411

[dgtlmoon]

I'm not sure about this... in the case that people have cdio configured with another variable to listen on a different port/ip inside the container its going to endlessly reboot it..

[dgtlmoon]

so many edge cases :(

[SiriosDev]

I'm not sure about this... in the case that people have cdio configured with another variable to listen on a different port/ip inside the container its going to endlessly reboot it..

Nope, it follow the PORT variable, and more importantly not reboot, healthcheck simply report to user (and system) health of the container based on what is in the healthcheck field (in this case a simple request)
The container only reboots when the main command encounters crashes or returns a non-zero exit code

[SiriosDev]

so many edge cases :(

I'd say more like best practices

[SiriosDev]

@dgtlmoon At the very least, if you really don't like the idea of shipping the health check directly, you might consider integrating curl, wget, or nc so that we individual users can run our own health checks without having to go through Python and all its overhead

[dgtlmoon]

@SiriosDev sorry man, i am severely sick and also juggling highly complex family life, i'll get back to it

[aleksa-radojicic]

@SiriosDev There is really no need adding another dependency because there are already ways to add healthcheck using tools already present in the Docker image, namely healthcheck via bash or via Python.

[SiriosDev]

@SiriosDev There is really no need adding another dependency because there are already ways to add healthcheck using tools already present in the Docker image, namely healthcheck via bash or via Python.

First and foremost, I’d prefer to respect the maintainer’s request for a break for the reasons mentioned above.

As for Bash: how? And even so, it wouldn’t be aware of the online status;
While for Python: I know that well—it’s what I’m using right now on my private instance—but since this application is definitely very memory-intensive, I’d like to avoid adding more load due to Python’s overhead, which I believe can be avoided in favor of something lighter.

[AmirF194]

Nice small addition, and it closes a long-standing request (#1411). The construction is careful: -f to fail on HTTP errors, -s -S to stay quiet but still surface the error text in docker inspect health logs, ${PORT:-5000} so a custom PORT is respected, and --start-period=30s so a slow boot does not flap the container to unhealthy. A lot of healthcheck PRs forget that last one.

I checked the two things that usually break a root-path healthcheck on this app, and both are fine. The port matches: the server reads port = int(os.environ.get('PORT', 5000)) and binds 0.0.0.0, lining up with EXPOSE 5000. And auth does not break it: with a password set, / returns a 302 redirect to login (via login_manager.unauthorized()), not a 401, and curl -f only fails on >= 400 and does not follow without -L, so it exits 0 and stays healthy. If that path had returned 401 this would flap forever, so it is worth knowing it is a redirect by design.

No blocking concerns. Two optional thoughts: the base image ships neither curl nor wget, so this does add curl plus libcurl (a few MB, negligible next to the playwright/opencv layers). Since Python already runs the app, a zero-install alternative is HEALTHCHECK ... CMD python -c "import os,urllib.request; urllib.request.urlopen('http://127.0.0.1:'+os.environ.get('PORT','5000')+'/')" (urllib follows the redirect and raises on >= 400). curl is more readable and the requester asked for it, so it is purely a size-versus-clarity call. Also, the port is settable via the -p CLI flag, which the healthcheck cannot see since it only reads PORT, so a one-line note in the compose comments ("set PORT if you change the listen port") would cover that case.

[dgtlmoon]

curl needs to be added to https://github.com/dgtlmoon/changedetection.io/blob/master/.github/test/Dockerfile-alpine also