This PR adds support for user-defined health-check probes for Docker
containers. It adds a `HEALTHCHECK` instruction to the Dockerfile syntax plus
some corresponding "docker run" options. It can be used with a restart policy
to automatically restart a container if the check fails.
The `HEALTHCHECK` instruction has two forms:
* `HEALTHCHECK [OPTIONS] CMD command` (check container health by running a command inside the container)
* `HEALTHCHECK NONE` (disable any healthcheck inherited from the base image)
The `HEALTHCHECK` instruction tells Docker how to test a container to check that
it is still working. This can detect cases such as a web server that is stuck in
an infinite loop and unable to handle new connections, even though the server
process is still running.
When a container has a healthcheck specified, it has a _health status_ in
addition to its normal status. This status is initially `starting`. Whenever a
health check passes, it becomes `healthy` (whatever state it was previously in).
After a certain number of consecutive failures, it becomes `unhealthy`.
The options that can appear before `CMD` are:
* `--interval=DURATION` (default: `30s`)
* `--timeout=DURATION` (default: `30s`)
* `--retries=N` (default: `1`)
The health check will first run **interval** seconds after the container is
started, and then again **interval** seconds after each previous check completes.
If a single run of the check takes longer than **timeout** seconds then the check
is considered to have failed.
It takes **retries** consecutive failures of the health check for the container
to be considered `unhealthy`.
There can only be one `HEALTHCHECK` instruction in a Dockerfile. If you list
more than one then only the last `HEALTHCHECK` will take effect.
The command after the `CMD` keyword can be either a shell command (e.g. `HEALTHCHECK
CMD /bin/check-running`) or an _exec_ array (as with other Dockerfile commands;
see e.g. `ENTRYPOINT` for details).
The command's exit status indicates the health status of the container.
The possible values are:
- 0: success - the container is healthy and ready for use
- 1: unhealthy - the container is not working correctly
- 2: starting - the container is not ready for use yet, but is working correctly
If the probe returns 2 ("starting") when the container has already moved out of the
"starting" state then it is treated as "unhealthy" instead.
For example, to check every five minutes or so that a web-server is able to
serve the site's main page within three seconds:
HEALTHCHECK --interval=5m --timeout=3s \
CMD curl -f http://localhost/ || exit 1
To help debug failing probes, any output text (UTF-8 encoded) that the command writes
on stdout or stderr will be stored in the health status and can be queried with
`docker inspect`. Such output should be kept short (only the first 4096 bytes
are stored currently).
When the health status of a container changes, a `health_status` event is
generated with the new status. The health status is also displayed in the
`docker ps` output.
Signed-off-by: Thomas Leonard <thomas.leonard@docker.com>
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Upstream-commit: b6c7becbfe1d76b1250f6d8e991e645e13808a9c
Component: engine
206 lines
6.0 KiB
Go
206 lines
6.0 KiB
Go
// Package parser implements a parser and parse tree dumper for Dockerfiles.
|
|
package parser
|
|
|
|
import (
|
|
"bufio"
|
|
"fmt"
|
|
"io"
|
|
"regexp"
|
|
"strings"
|
|
"unicode"
|
|
|
|
"github.com/docker/docker/builder/dockerfile/command"
|
|
)
|
|
|
|
// Node is a structure used to represent a parse tree.
|
|
//
|
|
// In the node there are three fields, Value, Next, and Children. Value is the
|
|
// current token's string value. Next is always the next non-child token, and
|
|
// children contains all the children. Here's an example:
|
|
//
|
|
// (value next (child child-next child-next-next) next-next)
|
|
//
|
|
// This data structure is frankly pretty lousy for handling complex languages,
|
|
// but lucky for us the Dockerfile isn't very complicated. This structure
|
|
// works a little more effectively than a "proper" parse tree for our needs.
|
|
//
|
|
type Node struct {
|
|
Value string // actual content
|
|
Next *Node // the next item in the current sexp
|
|
Children []*Node // the children of this sexp
|
|
Attributes map[string]bool // special attributes for this node
|
|
Original string // original line used before parsing
|
|
Flags []string // only top Node should have this set
|
|
StartLine int // the line in the original dockerfile where the node begins
|
|
EndLine int // the line in the original dockerfile where the node ends
|
|
}
|
|
|
|
var (
|
|
dispatch map[string]func(string) (*Node, map[string]bool, error)
|
|
tokenWhitespace = regexp.MustCompile(`[\t\v\f\r ]+`)
|
|
tokenLineContinuation *regexp.Regexp
|
|
tokenEscape rune
|
|
tokenEscapeCommand = regexp.MustCompile(`^#[ \t]*escape[ \t]*=[ \t]*(?P<escapechar>.).*$`)
|
|
tokenComment = regexp.MustCompile(`^#.*$`)
|
|
lookingForDirectives bool
|
|
directiveEscapeSeen bool
|
|
)
|
|
|
|
const defaultTokenEscape = "\\"
|
|
|
|
// setTokenEscape sets the default token for escaping characters in a Dockerfile.
|
|
func setTokenEscape(s string) error {
|
|
if s != "`" && s != "\\" {
|
|
return fmt.Errorf("invalid ESCAPE '%s'. Must be ` or \\", s)
|
|
}
|
|
tokenEscape = rune(s[0])
|
|
tokenLineContinuation = regexp.MustCompile(`\` + s + `[ \t]*$`)
|
|
return nil
|
|
}
|
|
|
|
func init() {
|
|
// Dispatch Table. see line_parsers.go for the parse functions.
|
|
// The command is parsed and mapped to the line parser. The line parser
|
|
// receives the arguments but not the command, and returns an AST after
|
|
// reformulating the arguments according to the rules in the parser
|
|
// functions. Errors are propagated up by Parse() and the resulting AST can
|
|
// be incorporated directly into the existing AST as a next.
|
|
dispatch = map[string]func(string) (*Node, map[string]bool, error){
|
|
command.User: parseString,
|
|
command.Onbuild: parseSubCommand,
|
|
command.Workdir: parseString,
|
|
command.Env: parseEnv,
|
|
command.Label: parseLabel,
|
|
command.Maintainer: parseString,
|
|
command.From: parseString,
|
|
command.Add: parseMaybeJSONToList,
|
|
command.Copy: parseMaybeJSONToList,
|
|
command.Run: parseMaybeJSON,
|
|
command.Cmd: parseMaybeJSON,
|
|
command.Entrypoint: parseMaybeJSON,
|
|
command.Expose: parseStringsWhitespaceDelimited,
|
|
command.Volume: parseMaybeJSONToList,
|
|
command.StopSignal: parseString,
|
|
command.Arg: parseNameOrNameVal,
|
|
command.Healthcheck: parseHealthConfig,
|
|
}
|
|
}
|
|
|
|
// ParseLine parse a line and return the remainder.
|
|
func ParseLine(line string) (string, *Node, error) {
|
|
|
|
// Handle the parser directive '# escape=<char>. Parser directives must preceed
|
|
// any builder instruction or other comments, and cannot be repeated.
|
|
if lookingForDirectives {
|
|
tecMatch := tokenEscapeCommand.FindStringSubmatch(strings.ToLower(line))
|
|
if len(tecMatch) > 0 {
|
|
if directiveEscapeSeen == true {
|
|
return "", nil, fmt.Errorf("only one escape parser directive can be used")
|
|
}
|
|
for i, n := range tokenEscapeCommand.SubexpNames() {
|
|
if n == "escapechar" {
|
|
if err := setTokenEscape(tecMatch[i]); err != nil {
|
|
return "", nil, err
|
|
}
|
|
directiveEscapeSeen = true
|
|
return "", nil, nil
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
lookingForDirectives = false
|
|
|
|
if line = stripComments(line); line == "" {
|
|
return "", nil, nil
|
|
}
|
|
|
|
if tokenLineContinuation.MatchString(line) {
|
|
line = tokenLineContinuation.ReplaceAllString(line, "")
|
|
return line, nil, nil
|
|
}
|
|
|
|
cmd, flags, args, err := splitCommand(line)
|
|
if err != nil {
|
|
return "", nil, err
|
|
}
|
|
|
|
node := &Node{}
|
|
node.Value = cmd
|
|
|
|
sexp, attrs, err := fullDispatch(cmd, args)
|
|
if err != nil {
|
|
return "", nil, err
|
|
}
|
|
|
|
node.Next = sexp
|
|
node.Attributes = attrs
|
|
node.Original = line
|
|
node.Flags = flags
|
|
|
|
return "", node, nil
|
|
}
|
|
|
|
// Parse is the main parse routine.
|
|
// It handles an io.ReadWriteCloser and returns the root of the AST.
|
|
func Parse(rwc io.Reader) (*Node, error) {
|
|
directiveEscapeSeen = false
|
|
lookingForDirectives = true
|
|
setTokenEscape(defaultTokenEscape) // Assume the default token for escape
|
|
currentLine := 0
|
|
root := &Node{}
|
|
root.StartLine = -1
|
|
scanner := bufio.NewScanner(rwc)
|
|
|
|
for scanner.Scan() {
|
|
scannedLine := strings.TrimLeftFunc(scanner.Text(), unicode.IsSpace)
|
|
currentLine++
|
|
line, child, err := ParseLine(scannedLine)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
startLine := currentLine
|
|
|
|
if line != "" && child == nil {
|
|
for scanner.Scan() {
|
|
newline := scanner.Text()
|
|
currentLine++
|
|
|
|
if stripComments(strings.TrimSpace(newline)) == "" {
|
|
continue
|
|
}
|
|
|
|
line, child, err = ParseLine(line + newline)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
if child != nil {
|
|
break
|
|
}
|
|
}
|
|
if child == nil && line != "" {
|
|
_, child, err = ParseLine(line)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
}
|
|
}
|
|
|
|
if child != nil {
|
|
// Update the line information for the current child.
|
|
child.StartLine = startLine
|
|
child.EndLine = currentLine
|
|
// Update the line information for the root. The starting line of the root is always the
|
|
// starting line of the first child and the ending line is the ending line of the last child.
|
|
if root.StartLine < 0 {
|
|
root.StartLine = currentLine
|
|
}
|
|
root.EndLine = currentLine
|
|
root.Children = append(root.Children, child)
|
|
}
|
|
}
|
|
|
|
return root, nil
|
|
}
|