Container Health and Signals

Container Health and Signals

Overview

Containers change process semantics: PID 1, signal delivery, and healthchecks. Go apps should handle SIGTERM, expose probes, and avoid zombie reaping issues (use a proper init if needed).

Dockerfile healthcheck (optional)

HEALTHCHECK --interval=10s --timeout=2s --retries=3 \
  CMD wget -qO- http://127.0.0.1:8080/livez || exit 1

Prefer orchestrator probes in K8s over relying only on Docker HEALTHCHECK.

Signal PID 1

If your app is PID 1 and spawns children, consider tini or ensure children are reaped. Many Go apps don’t spawn—still handle SIGTERM yourself.

ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGTERM, syscall.SIGINT)
defer stop()

Read-only rootfs

# run as non-root; mount emptyDir for temp if needed
USER nonroot:nonroot

Write only to /tmp or mounted volumes.

12-factor in containers

Concern	Practice
Config	env + files
Logs	stdout/stderr
Graceful	SIGTERM → Shutdown
Port	ADDR=:8080

Rules of thumb

Do	Don’t
Listen on 0.0.0.0/: in container	Hardcode localhost only for in-cluster listen
Exit non-zero on fatal boot	Hang forever if DB missing (or use restart policy consciously)
Document probe paths	Silent health

Try next

1. docker run + docker stop; measure drain time.
   
2. Read-only rootfs; fix writes to temp.
   
3. Align HEALTHCHECK with /livez.