Healthcheck: CMD vs CMD-SHELL
Docker can either run the command using the equivalent of the OS exec syscall directly in the kernel, or it can run a shell (typically /bin/sh) to call your command. A shell provides functionality you are accustom to from the command line, including:


I/O redirection and pipes (&gt;, &gt;&gt;, &lt;, etc)
Command chaining (&amp;&amp; and ||)
Variable expansion ($var)


However, a shell may also intercept signals, particularly when running as pid 1, which can prevent a graceful shutdown of a container (not much of an issue for a healthcheck). In addition, to run a the shell syntax, your container's image must include a shell, which means that won't work for images based on scratch that do not include a /bin/sh.