HEALTHCHECK belongs in the Dockerfile, not the orchestrator

Docker 1.12 added HEALTHCHECK, which means the image itself can say what “working” means. Before this, every orchestrator had to be told separately, and each one had its own syntax for the same curl command.

HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 
  CMD curl -fsS http://localhost/health || exit 1

The check runs inside the container, so it tests the application rather than the port being open — which is the difference between a PHP-FPM that is listening and one that can reach its database. Keep it cheap: it runs every interval on every container, so a health endpoint that queries three services is a self-inflicted load. Exit code 1 means unhealthy and 2 is reserved, so || exit 1 rather than letting curl’s own code through.