Add a in container exec based health check.

comment that it must assume to be rooted in the container's filesystem, rather than the host.