Container health checks in Docker work by running a command inside the container repeatedly. Each time the command runs, Docker checks its exit code. If the exit code is zero, Docker marks the container as healthy. If the exit code is not zero, Docker marks it as unhealthy. This status updates every time the health check runs. For example, a health check command might be 'curl -f http://localhost/'. If curl succeeds, the container is healthy; if curl fails, the container is unhealthy. The health check runs every few seconds as configured. The container status can change back and forth depending on the command results. This helps Docker and users know if the container is working properly.