Question: Is there a mechanism to see the database is started about azure-cosmos-db-emulator-docker

[arahmancsd]

I am using the followings to do the healthcheck for cosmos. Build image from the official image, add some extra tiny bits to it, define a different start using entrypoint.sh and check for certificate.

Docker file

FROM mcr.microsoft.com/cosmosdb/linux/azure-cosmos-emulator

RUN apt-get update && \
   apt-get -y install -y openssl && \
   apt-get install -y procps iputils-ping net-tools && \ 
   apt-get install -y wget && \
   apt-get -y install gpg && \
   rm -rf /var/lib/apt/lists/*

# Install tini
ENV TINI_VERSION v0.19.0
ADD https://github.com/krallin/tini/releases/download/${TINI_VERSION}/tini /tini
ADD https://github.com/krallin/tini/releases/download/${TINI_VERSION}/tini.asc /tini.asc
RUN gpg --batch --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys 595E85A6B1B4779EA4DAAEC70B588DFF0527A9B7 \
 && gpg --batch --verify /tini.asc /tini
RUN chmod +x /tini

# Create non-root user
RUN groupadd -g 1000 -r dev && \
   useradd -u 1000 -r -g dev -m -s $(which bash) dev
# Option '-m' to create home directory (see https://askubuntu.com/a/393470)
# Option '-s' to set shell for this user (see comment in https://askubuntu.com/a/393470)
# Option '-r' creates a system user which does not expire (see https://linuxize.com/post/how-to-create-users-in-linux-using-the-useradd-command/)

# Doesn't need to expose ports as they are part of main image
EXPOSE 8081
EXPOSE 8901
EXPOSE 8902
EXPOSE 10250
EXPOSE 10251
EXPOSE 10252
EXPOSE 10253
EXPOSE 10254
EXPOSE 10255
EXPOSE 10350

# Create working directory. Ownership will be changed in entrypoint.sh which
# executes *after* the volume has been mounted.
RUN mkdir /src
# Copy entrypoint script into container, make it executable, then execute it:
COPY ./entrypoint.sh ./
RUN chmod +x ./entrypoint.sh
# Option '+x' adds executable flag to the file

CMD ./entrypoint.sh & ./start.sh

entrypoint.sh

#!/bin/sh

sleep 5s

#################################################################################################################
# Provided the Dockerfile doesn't change the user, this script will run as 'root'. However, once VS Code connects
# it will connect remotely as user 'dev' [Manfred, 19sep2021]

#################################################################################################################
# Change ownership of all directories and files in the mounted volume:
chown -R dev:dev /src
# Option '-R' applies the ownerhip change recursively on files and directories in /src

#################################################################################################################
# Retrieve the self-signed SSL certificate of the CosmosDB Emulator and install in dev container
#
echo Retrieving self-signed SSL certificate from CosmosDB Emulator

retry=1
while true; do
    wget --no-check-certificate --output-document=/tmp/emulator.crt https://localhost:8081/_explorer/emulator.pem
    if [ "$?" -eq 0 ]
    then
        echo "wget successful"
        break
    else
        echo "******* Waiting for retry" $retry "*******"
        sleep 5s
    fi
    retry=`expr $retry + 1`
done

# Copy to well-known location
cp /tmp/emulator.crt /usr/local/share/ca-certificates
# Remove symbol link to trigger update of ca-certificates.crt file. 
# See http://manpages.ubuntu.com/manpages/xenial/man8/update-ca-certificates.8.html
rm -rf /etc/ssl/certs/emulator.pem 
# Trigger update of file with concatenated list of certificates:
update-ca-certificates > /tmp/update-ca-certificates-result.txt
# To check if the previous result was successful, check content of file /tmp/update-ca-certificates-result.txt
#
# To confirm the certificate was correctly installed, use the following command from inside the dev container. 
# Note that it doesn't use option '--no-check-certificate' which means, if successful, it used the certificate
# that was just installed:
#    wget https://demo-database.local:8081/_explorer/emulator.pem
#
# To check certificate DNS entries in the self-signed certificate with the following command
# openssl x509 -noout -text -in /tmp/emulator.crt


#################################################################################################################
# Finally invoke what has been specified as CMD in Dockerfile or command in docker-compose:
"$@"

Compose file Health Check only

healthcheck:
        test: ["CMD", "openssl", "x509", "-noout", "-text", "-in", "/tmp/emulator.crt"]
        interval: 10s
        timeout: 3s
        retries: 10