The healthcheck subcommand was reachable only after main()'s Infisical secrets resolution (4x retries/key, ~30s when Infisical is down), which blew the 5s Docker healthcheck timeout — so nomos stayed docker-unhealthy despite serving /healthz fine. Short-circuit 'nomos healthcheck' at the top of main() before any secrets init; measured 0.58s, no Infisical retries.
40 KiB
40 KiB