@@ -73,7 +73,10 @@ jobs:
         run:  make dev.provision.${{matrix.services}}
 
       - name: "Bring up services"
-        run:  make dev.up.${{matrix.services}}
+        # Use the without-wait variant: this job only provisions a subset of
+        # services, so their un-provisioned transitive dependencies can never
+        # become healthy.
+        run:  make dev.up.without-wait.${{matrix.services}}
 
       - name: "Wait for services to become ready"
         run: |
 
@@ -55,7 +55,8 @@
         dev.shell.cms_watcher dev.shell.xqueue dev.shell.xqueue_consumer \
         dev.static dev.static.lms dev.static.cms dev.stats dev.status \
         dev.stop dev.up dev.up.attach dev.up.shell \
-        dev.up.without-deps dev.up.without-deps.shell dev.up.with-programs \
+        dev.up.without-deps dev.up.without-deps.shell dev.up.without-wait \
+        dev.up.with-programs \
         dev.up.with-watchers dev.validate docs \
         help requirements impl-dev.clone.https impl-dev.clone.ssh impl-dev.provision \
         impl-dev.pull impl-dev.pull.without-deps impl-dev.up impl-dev.up.attach \
@@ -254,22 +255,27 @@ dev.up.with-watchers.%: ## Bring up services and their dependencies + asset watc
 dev.up.without-deps: _expects-service-list.dev.up.without-deps
 
 dev.up.without-deps.%: dev.check-memory ## Bring up services by themselves.
-	docker compose up -d --no-deps $$(echo $* | tr + " ")
+	docker compose up -d --wait --no-deps $$(echo $* | tr + " ")
 
 dev.up.without-deps.shell: _expects-service.dev.up.without-deps.shell
 
 dev.up.without-deps.shell.%: ## Bring up a service by itself + shell into it.
 	make dev.up.without-deps.$*
 	make dev.shell.$*
 
+dev.up.without-wait: _expects-service-list.dev.up.without-wait
+
+dev.up.without-wait.%: dev.check-memory ## Bring up services and their dependencies without waiting for them to become healthy.
+	docker compose up -d $$(echo $* | tr + " ")
+
 dev.up:
 	@scripts/make_warn_default_large.sh "$@"
 
 dev.up.large-and-slow: dev.up.$(DEFAULT_SERVICES) ## Bring up default services.
 	@echo # at least one statement so that dev.up.% doesn't run too
 
 dev.up.%: dev.check-memory ## Bring up services and their dependencies.
-	docker compose up -d $$(echo $* | tr + " ")
+	docker compose up -d --wait $$(echo $* | tr + " ")
 ifeq ($(ALWAYS_CACHE_PROGRAMS),true)
 	make dev.cache-programs
 endif
@@ -552,9 +558,6 @@ validate-lms-volume: ## Validate that changes to the local workspace are reflect
 	docker compose exec -T lms ls /edx/app/edxapp/edx-platform/testfile
 	rm $(DEVSTACK_WORKSPACE)/edx-platform/testfile
 
-hadoop-application-logs-%: ## View hadoop logs by application Id.
-	docker compose exec nodemanager yarn logs -applicationId $*
-
 create-test-course: ## Provisions cms, and ecommerce with course(s) in test-course.json.
 	bash ./course-generator/create-courses.sh --cms --ecommerce course-generator/test-course.json
 
 
@@ -1,15 +1,15 @@
 #!/usr/bin/env bash
-# Run checks for the provided service(s).
+# Run health checks for the provided service(s).
 # To specify multiple services, separate them with spaces or plus signs (+).
-# To specify all services, just pass in "all".
+# To specify all running services, just pass in "all".
 #
 # Examples:
 #  ./check.sh lms
 #  ./check.sh lms+forum
 #  ./check.sh lms+forum discovery
 #  ./check.sh all
 #
-# Exists 0 if successful; non-zero otherwise.
+# Exits 0 if successful; non-zero otherwise.
 #
 # Fails if no services specified.
 #
@@ -18,25 +18,11 @@
 
 set -eu -o pipefail
 
-# Grab all arguments into one string, replacing plus signs with spaces.
-# Pad on either side with spaces so that the regex in `should_check` works correctly.
-services=" ${*//+/ } "
-
 # Which checks succeeded and failed.
 succeeded=""
 failed=""
 
-# Returns whether service in first arg should be checked.
-should_check() {
-    local service="$1"
-    if [[ "$services" == *" all "* ]] || [[ "$services" == *" $service "* ]]; then
-        return 0  # Note that '0' means 'success' (i.e., true) in bash.
-    else
-        return 1
-    fi
-}
-
-# Runs a check named $1 on service $2 using the command $3.
+# Runs a check named $1 on service $2 using the host-side command $3.
 run_check() {
     local check_name="$1"
     local service="$2"
@@ -53,133 +39,75 @@ run_check() {
     echo  # Newline
 }
 
-mysql_run_check() {
-    container_name="$1"
-    mysql_probe="SELECT EXISTS(SELECT 1 FROM mysql.user WHERE user = 'root')"
-    # The use of `--protocol tcp` forces MySQL to connect over TCP rather than
-    # via a UNIX socket. This is needed because when MySQL starts for the first
-    # time in a new container, it starts a "temporary server" that runs for a
-    # few seconds and then shuts down before the "real" server starts up. The
-    # temporary server does not listen on the TCP port, but if the mysql
-    # command is not told which server to use, it will first try the UNIX
-    # socket and only after that will it try the default TCP port.
-    #
-    # By specifying that mysql should use TCP, we won't get an early false
-    # positive "ready" response while the temporary server is running.
-    run_check "${container_name}_query" "$container_name" \
-        "docker compose exec -T $(printf %q "$container_name") mysql --protocol tcp -uroot -se $(printf %q "$mysql_probe")"
+# Print a service container's Docker healthcheck status, one of:
+#   healthy | unhealthy | starting | none | missing
+# "none" means the container exists but declares no healthcheck; "missing"
+# means no container is running for the service.
+container_health() {
+    local service="$1" cid
+    cid="$(docker compose ps -q "$service" 2>/dev/null || true)"
+    if [[ -z "$cid" ]]; then
+        echo "missing"
+        return
+    fi
+    docker inspect \
+        --format '{{if .State.Health}}{{.State.Health.Status}}{{else}}none{{end}}' \
+        "$cid" 2>/dev/null || echo "missing"
 }
 
-if should_check mysql80; then
-    echo "Checking MySQL 8.0 query endpoint:"
-    mysql_run_check mysql80
-fi
-
-if should_check mongo; then
-    echo "Checking MongoDB status:"
-    run_check mongo_status mongo \
-        "docker compose exec -T mongo mongo --eval \"db.serverStatus()\""
-fi
-
-if should_check registrar; then
-    echo "Checking Registrar heartbeat:"
-    run_check registrar_heartbeat registrar \
-        "curl --fail -L http://localhost:18734/health"
-fi
-
-if should_check lms; then
-    echo "Checking LMS heartbeat:"
-    run_check lms_heartbeat lms \
-        "curl --fail -L http://localhost:18000/heartbeat"
-
-    echo "Validating LMS volume:"
-    run_check lms_volume lms \
-        "make validate-lms-volume"
-fi
-
-if should_check cms; then
-    echo "Checking CMS heartbeat:"
-    run_check cms_heartbeat cms \
-        "curl --fail -L http://localhost:18010/heartbeat"
-fi
-
-if should_check ecommerce; then
-    echo "Checking ecommerce health:"
-    run_check ecommerce_heartbeat ecommerce \
-        "curl --fail -L http://localhost:18130/health/"
-fi
-
-if should_check enterprise_access; then
-    echo "Checking enterprise-access health:"
-    run_check enterprise_access_heartbeat enterprise-access \
-        "curl --fail -L http://localhost:18130/health/"
-fi
-
-if should_check enterprise-subsidy; then
-    echo "Checking enterprise_subsidy health:"
-    run_check enterprise-subsidy_heartbeat enterprise-subsidy \
-        "curl --fail -L http://localhost:18280/health/"
-fi
-
-if should_check discovery; then
-    echo "Checking discovery health:"
-    run_check discovery_heartbeat discovery \
-        "curl --fail -L http://localhost:18381/health/"
-fi
-
-if should_check forum; then
-    echo "Checking forum heartbeat:"
-    run_check forum_heartbeat forum \
-        "curl --fail -L http://localhost:44567/heartbeat"
-fi
-
-if should_check edx_notes_api; then
-    echo "Checking edx_notes_api heartbeat:"
-    run_check edx_notes_api_heartbeat edx_notes_api \
-        "curl --fail -L http://localhost:18120/heartbeat"
-fi
-
-if should_check designer; then
-    echo "Checking designer health:"
-    run_check designer_heartbeat designer \
-        "curl --fail -L http://localhost:18808/health/"
-fi
-
-if should_check credentials; then
-    echo "Checking credentials heartbeat:"
-    run_check credentials_heartbeat credentials \
-        "curl --fail -L http://localhost:18150/health"
-fi
-
-if should_check xqueue; then
-    echo "Checking xqueue status:"
-    run_check xqueue_heartbeat xqueue \
-        "curl --fail -L http://localhost:18040/xqueue/status"
-fi
-
-if should_check insights; then
-    echo "Running Analytics Dashboard Devstack tests: "
-    run_check insights_heartbeat insights \
-        "curl --fail -L http://localhost:18110/health/"
-fi
+# Default check: pass iff the service's container reports itself healthy.
+# Services with no healthcheck (and no extra check) simply don't contribute a
+# check, matching the old behavior for unrecognized services.
+run_health_check() {
+    local service="$1"
+    local status
+    status="$(container_health "$service")"
+    case "$status" in
+        healthy)
+            echo "Checking $service: healthy"
+            succeeded="$succeeded ${service}_health"
+            echo
+            ;;
+        starting|unhealthy)
+            echo "Checking $service: $status"
+            docker compose logs --tail 500 "$service"
+            failed="$failed ${service}_health"
+            echo
+            ;;
+        none|missing)
+            # No container healthcheck to consult; rely on any extra checks.
+            :
+            ;;
+    esac
+}
 
-if should_check analyticsapi; then
-    echo "Running Analytics Data API Devstack tests: "
-    run_check analyticsapi_heartbeat analyticsapi \
-        "curl --fail -L http://localhost:19001/health/"
-fi
+# Extra/override checks for services that need more than their container
+# healthcheck can express. Keep this SMALL -- it is the only place service
+# names should be enumerated.
+run_extra_checks() {
+    local service="$1"
+    case "$service" in
+        lms)
+            echo "Validating LMS volume:"
+            run_check lms_volume lms "make validate-lms-volume"
+            ;;
+    esac
+}
 
-if should_check license-manager; then
-    echo "Running License Manager Devstack tests: "
-    run_check license_manager_heartbeat license-manager \
-        "curl --fail -L http://localhost:18170/health/"
+# Expand the requested services into a plain, space-separated list. "all"
+# means every service with a running container (word-splitting is safe here
+# because compose service names contain no whitespace).
+requested=" ${*//+/ } "
+if [[ "$requested" == *" all "* ]]; then
+    service_list="$(docker compose ps --services)"
+else
+    service_list="${*//+/ }"
 fi
 
-if should_check edx-exams; then
-    echo "Running edX Exam Devstack tests: "
-    run_check edx-exams_heartbeat edx-exams \
-        "curl --fail -L http://localhost:18740/health/"
-fi
+for service in $service_list; do
+    run_health_check "$service"
+    run_extra_checks "$service"
+done
 
 echo "Successful checks:${succeeded:- NONE}"
 echo "Failed checks:${failed:- NONE}"
 
@@ -0,0 +1,87 @@
+# Abstract base services, inherited by concrete services via `extends`.
+services:
+
+  # Traffic-serving backend app (Django/IDA) services.
+  backend-app:
+    stdin_open: true  # Allows `make dev.attach.<service>` to work correctly.
+    tty: true
+    # Concrete services may set these extra environment variables:
+    #
+    # - DEVSERVER_SETUP allows some services to run extra commands at the very beginning.
+    #   This is rarely needed.
+    # - DEVSERVER_CMD runs inside an infinite loop to allow `make dev.restart-devserver.<service>`
+    #   to work correctly.
+    #
+    # Examples:
+    #
+    #   environment:
+    #     DEVSERVER_SETUP: "source /edx/app/foo/foo_env"   # optional
+    #     DEVSERVER_CMD: "python manage.py runserver 0.0.0.0:18000"
+    command:
+      - bash
+      - -c
+      - |
+          if [ -n "$$DEVSERVER_SETUP" ]; then eval "$$DEVSERVER_SETUP"; fi
+          while true; do
+              eval "$$DEVSERVER_CMD"
+              sleep 2
+          done
+    # Configure a healthcheck to allow `make dev.up.<service>` to give accurate feedback
+    # about whether the service actually started successfully and is serving traffic.
+    #
+    # Set HEALTHCHECK_TARGET to the full URL curl should hit, e.g.:
+    #
+    #   environment:
+    #     HEALTHCHECK_TARGET: "http://localhost:18150/health/"
+    #
+    # Timings are sized so the worst case from container start to "give up"
+    # (marked unhealthy) is ~5 minutes: start_period + retries*interval = 300s = 5min.
+    healthcheck:
+      test: ["CMD-SHELL", "curl -fsS $$HEALTHCHECK_TARGET || exit 1"]
+      interval: 10s
+      timeout: 10s
+      retries: 6
+      start_period: 240s
+      start_interval: 5s  # poll fast during grace period so a healthy boot flips status quickly
+
+  # All microfrontends.
+  microfrontend:
+    # Use `npm ci` rather than `npm install` for a few reasons:
+    #
+    # - Repeatability: Respect the currently checked out package
+    #   versions rather than upgrading when package.json and
+    #   package-lock.json don't match. (Two people using this at
+    #   different times on the same commit should get the same
+    #   results.)
+    # - Immutability: Don't change the repo's working directory
+    #   unexpectedly when there's a lock mismatch.
+    #
+    # Fail fast if package install fails to avoid mysterious
+    # errors later.
+    command:
+      - bash
+      - -c
+      - |
+          npm ci || exit 1
+          if [ -n "$${PARAGON_BRAND_PACKAGE}" ]; then
+              npx paragon install-theme "$${PARAGON_BRAND_PACKAGE}" || exit 1
+          fi
+          while true; do
+              npm start
+              sleep 2
+          done
+    stdin_open: true
+    tty: true
+    image: node:18
+    environment:
+      - NODE_ENV=development
+    # MFEs take longer to startup: a cold `npm ci` + `npm start` is empirically
+    # observed to reach healthy in about 5 minutes, so we shouldn't give up
+    # until at least ~10 minutes. start_period + retries*interval = 600s = 10min.
+    healthcheck:
+      test: ["CMD-SHELL", "curl -fsS $$HEALTHCHECK_TARGET || exit 1"]
+      interval: 10s
+      timeout: 10s
+      retries: 6
+      start_period: 540s
+      start_interval: 5s  # poll fast during grace period so a healthy boot flips status quickly