provision/docker: healthcheck max-time read from config