feat: add built-in healthcheck function and update healthcheck command in Dockerfiles

Author: ChanningHe

Dockerfile

@@ -55,7 +55,7 @@ EXPOSE 8080 8081
 
 # Health check
 HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
-    CMD wget -q --spider http://localhost:8080/api/health || exit 1
+    CMD ["/app/labelgate", "healthcheck"]
 
 # Default command
 ENTRYPOINT ["/app/labelgate"]

cmd/labelgate/main.go

@@ -4,6 +4,8 @@ package main
 import (
 	"context"
 	"fmt"
+	"net"
+	"net/http"
 	"os"
 	"os/signal"
 	"syscall"
@@ -37,6 +39,11 @@ func main() {
 		os.Exit(0)
 	}
 
+	// Built-in healthcheck for distroless containers (no wget/curl available)
+	if flag.Arg(0) == "healthcheck" {
+		os.Exit(runHealthcheck(*configPath))
+	}
+
 	// Setup logger
 	zerolog.TimeFieldFormat = zerolog.TimeFormatUnix
 
@@ -231,6 +238,39 @@ func buildAgentConfigs(cfg *config.Config) map[string]*agent.AgentConfigEntry {
 	return result
 }
 
+// runHealthcheck performs an HTTP health check against the local API server.
+// It reuses the same config.Load path (env vars > config file > defaults)
+func runHealthcheck(configPath string) int {
+	addr := ":8080"
+	basePath := "/api"
+
+	if cfg, err := config.Load(configPath); err == nil {
+		addr = cfg.Api.Address
+		basePath = cfg.Api.BasePath
+	}
+
+	_, port, err := net.SplitHostPort(addr)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "healthcheck: invalid address %q: %v\n", addr, err)
+		return 1
+	}
+
+	url := "http://localhost:" + port + basePath + "/health"
+	client := &http.Client{Timeout: 2 * time.Second}
+	resp, err := client.Get(url)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "healthcheck failed: %v\n", err)
+		return 1
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		fmt.Fprintf(os.Stderr, "healthcheck failed: status %d\n", resp.StatusCode)
+		return 1
+	}
+	return 0
+}
+
 // runAgent runs labelgate in agent mode.
 func runAgent(ctx context.Context, cfg *config.Config) error {
 	// Initialize Docker provider

compose.dev.yaml

@@ -51,7 +51,7 @@ services:
       # - "8081:8081"
 
     healthcheck:
-      test: ["CMD", "wget", "-q", "--spider", "http://localhost:8080/api/health"]
+      test: ["/app/labelgate", "healthcheck"]
       interval: 30s
       timeout: 3s
       retries: 3

full.Dockerfile

@@ -69,7 +69,7 @@ EXPOSE 8080 8081
 
 # Health check
 HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
-    CMD wget -q --spider http://localhost:8080/api/health || exit 1
+    CMD ["/app/labelgate", "healthcheck"]
 
 # Default command
 ENTRYPOINT ["/app/labelgate"]