#3643 fix(docker): worker HEALTHCHECK, align docling lab digest, lab pip cache

User description

Summary

Small Docker review items (a companion to #3642, the Compose safety PR).

• Dockerfile.worker: add a HEALTHCHECK on /health. It resolves the port the same way worker/health.ts does (WORKER_HEALTH_PORT, then PORT). If neither is set, the health server is off, so the probe exits 1 with an explicit message instead of reporting healthy. Railway compatibility: Railway ignores Docker HEALTHCHECK (docs) and keeps gating deploys on railway.worker.json healthcheckPath: /health on PORT. The app Dockerfile already ships a HEALTHCHECK the same way. The instruction sits on one line because tests/tsx-server-only-runner.test.ts reads the first CMD-prefixed line as the entrypoint.
• eval/docling/Dockerfile: pin the same node:24-bookworm-slim@sha256:d6aa754f… digest as Dockerfile and Dockerfile.worker. The old pin was 235600a8…. Both are valid multi-arch OCI indexes.
• BuildKit cache mounts: added pip cache mounts only to the local docling lab image (eval/docling/Dockerfile), where --require-hashes still verifies every artifact. I did not add them to Dockerfile or Dockerfile.worker: tests/container-ci-contract.test.ts ("keeps Railway Dockerfiles portable across service IDs") forbids --mount=type=cache there, and I left that check as it is.

Areas touched: Delivery and assurance, Source intake and indexing

Verification

• vitest run on container-ci-contract, docling-model-artifacts, worker-shadow-extraction, tsx-server-only-runner, sentry-release, railway-config, database-skills, ci-audit-contracts and worker-bundle → Test Files 9 passed (9) / Tests 202 passed (202)
• I ran the healthcheck expression against a stub server. WORKER_HEALTH_PORT → exit 0; PORT → exit 0; neither set → exit 1 with "worker health server disabled"; server down → exit 1
• ci-change-scope → container_changed=true, so the required Docker image build and smoke run in CI. I couldn't build locally because the box has no Docker daemon.

Risk and rollout

• Risk: Low. The image gains a HEALTHCHECK, and Railway gating doesn't change. The lab image changes only its base digest and build cache.
• Rollback: Revert this PR.
• Provider or production effects: None.

Notes

• I didn't bump Trivy here, as requested. A future PR can update the Trivy version or action used by scripts/trivy-image-scan.mjs.

Summary by cubic

Adds a container-runtime health probe to the worker image and aligns the docling lab image with the main Dockerfiles.

• Worker HEALTHCHECK probes /health on WORKER_HEALTH_PORT, falling back to PORT like worker/health.ts; if neither is set it exits 1 with an explicit message instead of claiming healthy.
• docker-compose.yml sets WORKER_HEALTH_PORT: 8000 for the health probe; no host port is exposed.
• Railway ignores HEALTHCHECK and keeps gating on railway.worker.json, so deploy behavior is unchanged.
• The lab image's node:24-bookworm-slim pin now matches the digest used by Dockerfile and Dockerfile.worker.
• BuildKit pip cache mounts speed up lab rebuilds; --require-hashes still verifies every artifact, and run-lab.sh now requires a BuildKit builder. The Railway images intentionally keep cache mounts out per container-ci-contract.test.ts.
• The healthcheck stays on one line because tsx-server-only-runner.test.ts reads the first CMD-prefixed line as the entrypoint.

CodeAnt-AI Description

Add worker container health checks and speed up Docling lab rebuilds

What Changed

• Docker and Compose can now detect when the worker’s /health endpoint is unavailable; the probe reports unhealthy if no health port is configured.
• Docling lab rebuilds reuse cached Python packages while still verifying dependencies.
• The Docling lab image now uses the same pinned base image as the application and worker images.

Impact

✅ Clearer worker container health status
✅ Faster Docling lab rebuilds
✅ Consistent base image across containers

@codeant-ai ask: Your question here

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

@codeant-ai: Your feedback here

@codeant-ai: Do not flag unused imports.

@codeant-ai: review

Summary by Gitar

• Compose configuration:
  • Set WORKER_HEALTH_PORT: 8000 on the worker service in docker-compose.yml for the internal health listener

_{This will update automatically on new commits.}

Summary by CodeRabbit

• Reliability
  • Added Docker health monitoring for the worker, using its configured health-check port and reporting unhealthy when the endpoint is unavailable or returns an error.
• Developer Tools
  • The document-processing benchmark now checks for a working Docker Buildx builder before building and enables BuildKit for the build.
  • Improved dependency installation caching in the benchmark image build to help speed up repeated builds.