FAQ: describe solutions to the invalid healthcheck error

docs/faq.md

@@ -144,3 +144,31 @@ secrets:
 
 ### "Stack:… is in UPDATE_COMPLETE_CLEANUP_IN_PROGRESS state and cannot be updated"
 - This happens if different version of the Defang CLI are used with the same AWS account. Each version one will try to update the CD stack to its version, back and forth. Make sure that all users have the same version of the CLI. Check the CLI version using `defang version`.
+
+### "invalid healthcheck: ingress ports require an HTTP healthcheck on `localhost`.
+
+- This message is displayed when `defang compose up` tries to deploy a service with an "ingress" port, if the service does not have a `healthcheck` which mentions `localhost`. Defang routes a load balancer to your service's ingress ports, and the loadbalancer needs to be able to check the health of the service. Two solve this issue, ask yourself these two questions:
+
+1. Should my service be public? It's common to declare your container's ports using the Compose file "shorthand" syntax (`1234:1234`). This syntax can be understood as `[HOST:]CONTAINER`. If your service is not intended to be public, you do not need to declare a HOST port. For example:
+
+    ```diff
+       services:
+         my-service:
+           image: my-image
+           ports:
+    -       - "1234:1234"
+    +       - "1234"
+    ```
+2. Does my healthcheck include the string `localhost`? It is very common to define a healthcheck by using `curl` or `wget` to make a request to `localhost`. So common, in fact, that defang will look for the string `localhost` in your healthcheck definition. For example, this healthcheck is valid:
+
+    ```yaml
+     healthcheck:
+       test: ["CMD", "curl", "-f", "http://localhost:1234/health"]
+    ```
+
+    This healthcheck is not valid:
+
+    ```yaml
+     healthcheck:
+       test: ["CMD", "./my-healthcheck"]
+    ```