The app's health check ran on the target host against the container name, which only resolves inside the Docker network, so the wait could never succeed. Poll the image's HEALTHCHECK instead and fail with a readable message. Also pin site.env to the app user when it exists, and say how to install the provisioning script on the server.