It runs the same image with the settings a service that stays up wants: it
restarts unless stopped, mounts the filesystem read-only because the service
writes nothing, drops the ability to gain privileges, and probes the service
every thirty seconds.
The probe is written against the shell rather than against a tool, because
the image carries no HTTP client. It opens the connection as a file
descriptor with `bash`, writes the request, and reads the status line back.
That was checked against a running service and against a stopped one: it
reports healthy in the first case and unhealthy in the second, which is the
only thing a probe has to get right.
The host port is a variable with a default, because which port a machine has
free is a matter of taste, and the build context is the directory above, as
the Dockerfile's is.
dev