healthcheck without a shell is not working

[vikstrous]

Dockerfile healthchecks don't seem to work if there is no /bin/sh in the container even when using the [""] syntax to specify an executable to run.

Output of docker version:

Client:
 Version:      1.12.1-rc2
 API version:  1.24
 Go version:   go1.6.3
 Git commit:   236317f-unsupported
 Built:        Thu Aug 18 17:11:17 2016
 OS/Arch:      linux/amd64

Server:
 Version:      1.12.1-rc2
 API version:  1.24
 Go version:   go1.6.3
 Git commit:   236317f-unsupported
 Built:        Thu Aug 18 17:11:17 2016
 OS/Arch:      linux/amd64

(equivalent to 1.12.1 for the purpose of this bug report)

Output of docker info:

Containers: 20
 Running: 20
 Paused: 0
 Stopped: 0
Images: 314
Server Version: 1.12.1-rc2
Storage Driver: overlay2
 Backing Filesystem: extfs
Logging Driver: json-file
Cgroup Driver: cgroupfs
Plugins:
 Volume: local
 Network: host overlay bridge null
Swarm: inactive
Runtimes: runc
Default Runtime: runc
Security Options: seccomp
Kernel Version: 4.7.2-1-ARCH
Operating System: Arch Linux
OSType: linux
Architecture: x86_64
CPUs: 4
Total Memory: 7.708 GiB
Name: compooter
ID: GKSI:YHZC:YPNI:PAGO:EYPD:AYME:K6BY:BAIH:EBKQ:SOAK:WUFP:6MJM
Docker Root Dir: /var/lib/docker
Debug Mode (client): false
Debug Mode (server): true
 File Descriptors: 233
 Goroutines: 321
 System Time: 2016-08-30T17:13:05.024036433-07:00
 EventsListeners: 1
Username: viktorstanchev
Registry: https://index.docker.io/v1/
Cluster Store: etcd://172.17.0.1:12379
Cluster Advertise: 172.17.0.1:12376
Insecure Registries:
 172.17.0.1
 192.168.0.106
 dtr2-2061409770.us-west-2.elb.amazonaws.com
 new-1428125395.us-west-2.elb.amazonaws.com
 127.0.0.0/8

Additional environment details (AWS, VirtualBox, physical, etc.):

Steps to reproduce the issue:

1. Put this in a Dockerfile:

   FROM alpine
   RUN rm /bin/sh
   HEALTHCHECK CMD ["/bin/ls"]
   

2. docker build -t fail .

3. docker run -d --name test --entrypoint sleep fail 1000

4. docker inspect test

Describe the results you received:

        "State": {
            "Status": "running",
            "Running": true,
            "Paused": false,
            "Restarting": false,
            "OOMKilled": false,
            "Dead": false,
            "Pid": 27023,
            "ExitCode": 0,
            "Error": "",
            "StartedAt": "2016-08-31T00:10:36.73639074Z",
            "FinishedAt": "0001-01-01T00:00:00Z",
            "Health": {
                "Status": "starting",
                "FailingStreak": 2,
                "Log": [
                    {
                        "Start": "2016-08-30T17:11:06.744076383-07:00",
                        "End": "2016-08-30T17:11:06.794280711-07:00",
                        "ExitCode": -1,
                        "Output": "rpc error: code = 2 desc = oci runtime error: exec failed: exec: \"/bin/sh\": stat /bin/sh: no such file or directory"
                    },
                    {
                        "Start": "2016-08-30T17:11:36.794440699-07:00",
                        "End": "2016-08-30T17:11:36.846618677-07:00",
                        "ExitCode": -1,
                        "Output": "rpc error: code = 2 desc = oci runtime error: exec failed: exec: \"/bin/sh\": stat /bin/sh: no such file or directory"
                    }
                ]
            }

Describe the results you expected:
health check should succeed

Additional information you deem important (e.g. issue happens only occasionally):
In the config section of docker inspect I see:

            "Healthcheck": {
                "Test": [
                    "CMD-SHELL",
                    "/bin/ls"
                ]
            },

[vdemeester]

Marking this as enhancement because it's not working by design it seems, but I really think it should work 👼. I'll take a look, but /cc @talex5

[vikstrous]

Well, according to the documentation, it should work, so it looks more like a bug to me. https://docs.docker.com/engine/reference/builder/#healthcheck

[vdemeester]

@vikstrous true 👼 but according to code, it calls sh 😓

[talex5]

This is certainly a bug. docker inspect should show CMD, not CMD-SHELL in this case.

In wonder if we're attaching the json attribute to the wrong AST node. It's supposed to return it here:

https://github.com/docker/docker/blob/ad6f5a49d5f24f8b64def11176b6c8df162d839f/builder/dockerfile/parser/line_parsers.go#L360

and check it here:

https://github.com/docker/docker/blob/ad6f5a49d5f24f8b64def11176b6c8df162d839f/builder/dockerfile/dispatchers.go#L495

[yegle]

I think there's a regression here.

My docker version:

$ docker version       
Client:
 Version:           18.09.5
 API version:       1.39
 Go version:        go1.10.8
 Git commit:        e8ff056dbc
 Built:             Thu Apr 11 04:44:28 2019
 OS/Arch:           linux/amd64
 Experimental:      false

Server: Docker Engine - Community
 Engine:
  Version:          18.09.5
  API version:      1.39 (minimum version 1.12)
  Go version:       go1.10.8
  Git commit:       e8ff056
  Built:            Thu Apr 11 04:10:53 2019
  OS/Arch:          linux/amd64
  Experimental:     false

The docker file: https://github.com/yegle/stubby-docker/blob/test-dockerfile-cmd/Dockerfile

docker inspect result:

            "Healthcheck": {
                "Test": [
                    "CMD-SHELL",
                    "[\"/bin/getdns_server_mon\" \"-M\" \"-t\" \"@127.0.0.1\" \"lookup\" \"google.com\"]"
                ]
            },

Health check log:

OCI runtime exec failed: exec failed: container_linux.go:345: starting container process caused "exec: \"/bin/sh\": stat /bin/sh: no such file or directory": unknown

[yegle]

/facepalm

No regression here. I wrote ["cmd" "arg1" "arg2"] instead of ["cmd", "arg1", "arg2"].