feat: add HEALTHCHECK to all Dockerfiles

[Meemaw]

Summary

Adds a Docker HEALTHCHECK instruction to all four Dockerfiles (Dockerfile, Dockerfile.jvm-package, Dockerfile.native, Dockerfile.native-package) so orchestration tools can detect readiness without a custom healthcheck definition. This makes the Floci image a better drop-in replacement for LocalStack, which includes a built-in healthcheck.

Each image uses whichever HTTP tool is already present in the base image — no new packages are installed:

Dockerfile	Base image	Tool	Command
Dockerfile	eclipse-temurin:25-jre-alpine	wget (BusyBox)	wget -q --spider
Dockerfile.jvm-package	eclipse-temurin:25-jre-alpine	wget (BusyBox)	wget -q --spider
Dockerfile.native-package	ubi9-minimal:9.7	curl (pre-installed)	curl -f
Dockerfile.native	quarkus-micro-image:2.0	bash /dev/tcp	TCP connect via bash built-in

All healthchecks target the existing /_floci/health endpoint on port 4566.

Type of change

• Bug fix (fix:)
• New feature (feat:)
• Breaking change (feat!: or fix!:)
• Docs / chore

AWS Compatibility

N/A — infrastructure-only change, no wire protocol impact.

⚠️ Review closely

• Dockerfile.native uses bash /dev/tcp: The quarkus-micro-image:2.0 base image has neither curl nor wget. The healthcheck falls back to bash -c '... > /dev/tcp/localhost/4566', which only verifies TCP connectivity — it does not check the HTTP response status code. If the server is listening but returning errors (e.g. 500), this healthcheck will still pass. Consider whether this is acceptable or whether installing curl/wget via microdnf is preferred for a proper HTTP-level check.
• BusyBox wget --spider: Alpine's BusyBox wget supports --spider, but its behavior may differ slightly from GNU wget. Verify the healthcheck succeeds on Alpine-based images.

Checklist

• ./mvnw test passes locally
• New or updated integration test added — N/A (Dockerfile-only change)
• Commit messages follow Conventional Commits

Link to Devin session: https://app.devin.ai/sessions/06b7e28f3e664783b17ed18060e5c267
Requested by: @Meemaw

---

[devin-ai-integration]

Original prompt from Matej

switch from localstsvk to floci. Minimal vode changes, just change the container image

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 2 additional findings.

[devin-ai-integration]

Devin Review found 2 new potential issues.

View 6 additional findings in Devin Review.

[devin-ai-integration]

🔴 HEALTHCHECK uses curl which is not installed in ubi9-minimal base image

The ubi9-minimal:9.7 base image does not include curl by default (it ships with only microdnf and a very minimal set of utilities). The HEALTHCHECK command curl -f http://localhost:4566/_floci/health will always fail with a "command not found" error, causing Docker to permanently mark the container as unhealthy. This can trigger restart loops in orchestrators or block dependent services that use depends_on: condition: service_healthy.

Prompt for agents

The HEALTHCHECK in Dockerfile.native-package uses `curl` but the base image `registry.access.redhat.com/ubi9-minimal:9.7` does not include curl. Options to fix: (1) Install curl-minimal via microdnf: add `RUN microdnf install -y curl-minimal && microdnf clean all` before the HEALTHCHECK. (2) Use a tool already present in ubi9-minimal, such as a shell-based TCP check if available. (3) Match the pattern used in Dockerfile.native with a raw TCP approach, but ensure the shell supports it (ubi9-minimal has bash available unlike micro images). For example: `CMD bash -c 'echo -e "GET /_floci/health HTTP/1.0\r\nHost: localhost\r\n\r\n" > /dev/tcp/localhost/4566' || exit 1`.

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[devin-ai-integration]

False positive — curl is present in ubi9-minimal:9.7:

$ docker run --rm registry.access.redhat.com/ubi9-minimal:9.7 ls -lh /usr/bin/curl
-rwxr-xr-x 1 root root 193K Dec  2 11:04 /usr/bin/curl

$ docker run --rm registry.access.redhat.com/ubi9-minimal:9.7 curl --version | head -1
curl 7.76.1 (x86_64-redhat-linux-gnu) libcurl/7.76.1 OpenSSL/3.5.1 zlib/1.2.11 nghttp2/1.43.0

[devin-ai-integration]

🔴 HEALTHCHECK uses bash which is not available in quarkus-micro-image base image

The quarkus-micro-image:2.0 is based on UBI Micro, an extremely minimal image that does not include bash (only /bin/sh at most, and no package manager to install it). The HEALTHCHECK command bash -c 'echo -e "GET /_floci/health HTTP/1.0\r\n..." > /dev/tcp/localhost/4566' will fail because bash is not found. Additionally, the /dev/tcp pseudo-device is a bash-specific feature unavailable in other shells. The container will be permanently marked unhealthy by Docker, which can cause restart loops and block dependent services.

Prompt for agents

The HEALTHCHECK in Dockerfile.native uses `bash` and bash-specific `/dev/tcp` but the base image `quarkus-micro-image:2.0` (UBI Micro) has neither bash nor a package manager to install it. Since UBI Micro is intentionally stripped down, there are limited options: (1) Install a small static HTTP client binary (e.g. copy a statically-compiled curl or wget from a build stage). (2) Use a Quarkus-native health check mechanism instead of a Docker HEALTHCHECK. (3) Switch to a slightly less minimal base image (e.g. ubi-minimal) that includes or can install bash/curl. (4) Use the native application itself to implement a health-check subcommand if supported.

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[devin-ai-integration]

False positive — bash is present in quarkus-micro-image:2.0:

$ docker run --rm quay.io/quarkus/quarkus-micro-image:2.0 bash --version | head -1
GNU bash, version 4.4.20(1)-release (x86_64-redhat-linux-gnu)

And /dev/tcp works as expected (returns "Connection refused" when no server is running, confirming bash processes the pseudo-device):

$ docker run --rm quay.io/quarkus/quarkus-micro-image:2.0 bash -c 'echo > /dev/tcp/localhost/4566' 2>&1
bash: connect: Connection refused