fleetwide.yaml: health and readiness

Ship a /fleetwide/fleetwide.yaml in your image. The health check decides whether a release is good, so a release that cannot pass it never becomes the one every container is on. Every field is optional; an image without the file gets the defaults below, where health means the process is alive and the answer to unhealthy is a restart.

# /fleetwide/fleetwide.yaml, inside your image. Every field is optional.
name: my-app
version: "1.4.2"
health:
  http: http://127.0.0.1:8080/healthz   # or tcp: 127.0.0.1:5432, or exec: ["/bin/check"]
  interval: 10s                         # timeout must be shorter than interval
  timeout: 3s
  grace: 15s                            # failures ignored this long after a (re)start
  failure_threshold: 3
  on_unhealthy: restart                 # restart | ignore
  max_restarts: 5                       # then the supervisor exits 1
  restart_backoff: 5s
  stop_timeout: 30s                     # SIGTERM, then SIGKILL
rollback:
  on_unhealthy_for: 60s                 # an unconfirmed release unhealthy this long is rolled back
  keep_versions: 2
ready:
  listen: ":9100"                       # serves /fleetwide/ready, /fleetwide/live, /fleetwide/status

One of http, tcp or exec. An HTTP probe counts 2xx and 3xx as healthy. on_unhealthy is restart or ignore; after max_restarts the supervisor gives up and exits, which lets an orchestrator recreate the container.

The app's Healthcheck tab in the console defines the same probe. It wins over the file, and it reaches running containers on their next check-in without a new release, so a bad probe can be fixed without republishing.

ready.listen opens three endpoints on that address: /fleetwide/ready answers 200 once the app is running and has passed a check, /fleetwide/live answers 200 while the app runs or the supervisor is between releases, and /fleetwide/status returns JSON. Point your orchestrator's probes at them when you want it to see what the supervisor sees. A fleet's readiness switch opens them on :9100 for apps that set no address.