Healthchecks that check the thing, not the port

A container health check that opened a TCP connection to 9000 and reported healthy while every request returned a 500.

# what it was
HEALTHCHECK CMD nc -z localhost 9000 || exit 1

# what it is
HEALTHCHECK --interval=15s --timeout=3s --start-period=30s 
  CMD php-fpm-healthcheck --accepted-conn=1000 
      || exit 1

# and for the application container, an endpoint that
# touches the database and the cache once, cheaply.

A port check answers “did the process start”, which is a different question from “can it serve”. The counter-risk is a health check that is too thorough: one that queries three dependencies will mark the container unhealthy when a dependency blips, and an orchestrator will then restart a container that was fine. --start-period is the flag that stops a slow boot being read as a failure, and it is the one most often omitted.