[..] or need to set an exit status

Curl uses a lot of different return codes. The healthcheck however expects just 0 or 1. || exit 1 converts return codes > 1 to 1.

I don't like the new approach, because it pollutes the mail.log every 30 seconds with something like:

Jun  1 12:45:32 mail postfix/postscreen[18492]: CONNECT from [127.0.0.1]:46020 to [127.0.0.1]:25
Jun  1 12:45:32 mail postfix/postscreen[18492]: ALLOWLISTED [127.0.0.1]:46020
Jun  1 12:45:32 mail postfix/smtpd[18493]: connect from localhost[127.0.0.1]
Jun  1 12:45:32 mail opendmarc[2397]: ignoring connection from localhost
Jun  1 12:45:32 mail postfix/smtpd[18493]: lost connection after CONNECT from localhost[127.0.0.1]
Jun  1 12:45:32 mail postfix/smtpd[18493]: disconnect from localhost[127.0.0.1] commands=0/0

This might also introduce problems with fail2ban. IIRC using mode ddos or agressive, it looks for "connect" / "disconnect" patterns.

Edit:

To achieve a cleaner output, we could use: ss --ipv4 --listening --tcp --numeric | grep -o '0.0.0.0:25', which only returns 0.0.0.0:25

Curl uses a lot of different return codes. The healthcheck however expects just 0 or 1. || exit 1 converts return codes > 1 to 1.

Where is curl involved here? Isn't the exit status coming from the grep command otherwise?

I don't like the new approach, because it pollutes the mail.log every 30 seconds with something lik

I was not aware of that and you raise very valid points, thanks for pointing that out! 🙏

To achieve a cleaner output, we could use: ss --ipv4 --listening --tcp --numeric | grep -o '0.0.0.0:25', which only returns 0.0.0.0:25

Is there value in that output being stored repeated in the healthcheck log?

Shouldn't we just use grep -q for 0/1 exit status? As per the grep docs:

Exit Status

Normally, the exit status is 0 if selected lines are found and 1 otherwise.
But the exit status is 2 if an error occurred, unless the -q or --quiet or --silent option is used and a selected line is found.

Where is curl involved here? Isn't the exit status coming from the grep command otherwise?

My bad. I was looking at another healthcheck example while writing. It was however just to explain the || exit 1 usage / best-practice.

Shouldn't we just use grep -q for 0/1 exit status?

That will work. Only disadvantage: when grep fails (return code 2) for whatever reason, it will happen silently.

Shouldn't we just use grep -q for 0/1 exit status?

That will work. Only disadvantage: when grep fails (return code 2) for whatever reason, it will happen silently.

I assume the exit status of 2 becomes 1 in that case, but I'm not sure how to verify that.

If grep is given an invalid arg or invalid filepath to search you still get an exit status of 2, despite --quiet / --silent. Presumably a valid command can error and instead of 2 you'd get 1?

I suppose we could keep || exit 1 tacked on as a precaution? 🤷‍♂️

https://docs.docker.com/reference/dockerfile/#healthcheck

The command's exit status indicates the health status of the container.

The possible values are:

• 0: success - the container is healthy and ready for use
• 1: unhealthy - the container isn't working correctly
• 2: reserved - don't use this exit code