# CL-0015: Healthcheck Disabled

**Severity:** LOW

**References:**
- CIS Docker Benchmark 4.6 — Ensure that HEALTHCHECK instructions have been added to container images
- CIS Docker Benchmark 5.27 — Ensure that container health is checked at runtime

## What it detects

Services that explicitly disable their healthcheck, in either form: `healthcheck.disable: true`, or a `healthcheck.test` of `["NONE"]` / `"NONE"` (the Compose spec's way of clearing an image's inherited healthcheck). Services without a healthcheck configuration, or with `disable: false`, are not flagged — this rule targets explicit opt-outs only.

## Why it matters

The security angle is narrow but real: a container that is *running but compromised* — for example, an attacker has crashed the legitimate process and replaced it with a reverse shell that doesn't pass the healthcheck — looks healthy to the orchestrator without `HEALTHCHECK`. Healthchecks are a weak signal of "the workload is doing the thing it's supposed to," and disabling them removes one of the few automated tripwires that distinguishes "process is alive" from "the right process is alive." Disabling also overrides any `HEALTHCHECK` instruction in the Dockerfile, which the image author may have written specifically because of a known stuck-but-listening failure mode.

This is the lowest-severity rule for a reason. It is more reliability than security, and a well-architected system should not depend on `HEALTHCHECK` for incident detection. It is included because the explicit-disable case is rare and worth a question.

## Fix

Remove `disable: true` and configure an appropriate healthcheck:

```yaml
# Before
services:
  app:
    image: myapp:1.0
    healthcheck:
      disable: true

# After
services:
  app:
    image: myapp:1.0
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost/"]
      interval: 30s
      timeout: 10s
      retries: 3
```

If the image already has a `HEALTHCHECK` instruction, simply removing the `healthcheck:` block entirely will restore the image's built-in check.
