Docker-openldap: mounting ldif dir won't work

[doertedev]

Hi.

I'm doing this from a VM:

rm -rf ./ldif && cp -r /vagrant/ldif/ . && chmod 777 -R ./ldif && docker run --name="openldap" --rm -p 389:389 -v /vagrant/ldap/docker.env.yaml:/container/environment/01-custom/env.yaml -v /root/ldif:/container/service/slapd/assets/config/bootstrap/ldif/custom osixia/openldap:1.1.11

Which fails with:

*** CONTAINER_LOG_LEVEL = 3 (info)
*** Search service in CONTAINER_SERVICE_DIR = /container/service :
*** link /container/service/:ssl-tools/startup.sh to /container/run/startup/:ssl-tools
*** link /container/service/slapd/startup.sh to /container/run/startup/slapd
*** link /container/service/slapd/process.sh to /container/run/process/slapd/run
*** Set environment for startup files
*** Environment files will be proccessed in this order : 
Caution: previously defined variables will not be overriden.
/container/environment/01-custom/env.yaml
/container/environment/99-default/default.yaml
/container/environment/99-default/default.startup.yaml

To see how this files are processed and environment variables values,
run this container with '--loglevel debug'
*** Running /container/run/startup/:ssl-tools...
*** Running /container/run/startup/slapd...
Database and config directory are empty...
Init new ldap server...
invoke-rc.d: could not determine current runlevel
invoke-rc.d: policy-rc.d denied execution of stop.
  Backing up /etc/ldap/slapd.d in /var/backups/slapd-2.4.44+dfsg-5+deb9u1... done.
  Creating initial configuration... done.
  Creating LDAP directory... done.
invoke-rc.d: could not determine current runlevel
invoke-rc.d: policy-rc.d denied execution of start.
Start OpenLDAP...
Waiting for OpenLDAP to start...
Add bootstrap schemas...
config file testing succeeded
Add image bootstrap ldif...
Add read only user...
Add custom bootstrap ldif...
Disable replication config...
Stop OpenLDAP...
Remove config files...
rm: cannot remove '/container/service/slapd/assets/config/bootstrap/ldif/custom': Device or resource busy
*** /container/run/startup/slapd failed with status 1

*** Killing all processes...

Copy-mounting the parent directory in there won't work either because then he can't find the other files:
sed: can't read /container/service/slapd/assets/config/bootstrap/ldif/01-config-password.ldif: No such file or directory

Advice?

[jbpin]

I have the same issue using Kubernetes (minikube) and configMap

I map the configMap to a volume in the deployment yaml file.

Remove config files...
rm: cannot remove '/container/service/slapd/assets/config/bootstrap/ldif/custom': Device or resource busy

[jbpin]

Actually I solve my issue. It was related to the spec config. I try to execute the run command with two arguments.

Here is my configuration

spec:
      containers:
        - name: ldap
          image: osixia/openldap:1.1.11
          command: ["/bin/sh"]
          args: ["-c", "/container/tool/run --copy-service -l debug"]

BTW my schema and my ldif script are not executed during the initialization of the container... I didn't find any trace in the log :/

I keep going...

[doertedev]

Worked around this by copying my files into a clone of this repo + making my own docker image. But this doesn't fix the issue.

[jbpin]

Ok I found my issue

When mounting the configMap in the volume, there is symlink in the folder..

drwxrwxrwx 3 openldap openldap 4096 Dec 29 14:51 .
drwxrwxr-x 1 openldap openldap 4096 Dec 29 14:50 ..
lrwxrwxrwx 1 openldap openldap   24 Dec 29 14:49 01-structure.ldif -> ..data/01-structure.ldif
lrwxrwxrwx 1 openldap openldap   23 Dec 29 14:49 02-security.ldif -> ..data/02-security.ldif
lrwxrwxrwx 1 openldap openldap   21 Dec 29 14:49 03-entity.ldif -> ..data/03-entity.ldif
lrwxrwxrwx 1 openldap openldap   22 Dec 29 14:49 04-dynlist.ldif -> ..data/04-dynlist.ldif
drwxr-xr-x 2 root     root     4096 Dec 29 14:51 ..129812_29_12_14_51_11.177775222
lrwxrwxrwx 1 root     root       33 Dec 29 14:51 ..data -> ..129812_29_12_14_51_11.177775222

but with --copy-service everything is copied as normal file and so doing

find ... -type f

return duplicate file... I solve my problem without usign --copy-service and putting LDAP_REMOVE_CONFIG_AFTER_SETUP to false.

Also starting the container (v1.1.11) with kubernetes give me not empty volume for /etc/ldap/slapd.d nor /var/lib/ldap ... I fixed that using a startup script with simple RM.... unfortunately this is not a solution.

Any help is welcome... Thanks

[jacobwalkr]

I'm having a very similar issue. Using Docker Compose, the LDAP service never becomes available. Here is part of my docker-compose.yml:

ldap:
  # https://github.com/osixia/docker-openldap
  environment:
    - LDAP_DOMAIN="example.com"
    - LDAP_ADMIN_PASSWORD="secret"
  image: "osixia/openldap:latest"
  networks:
    - test-net
  volumes:
    - ./spec/fixtures/ldap.ldif:/container/service/slapd/assets/config/bootstrap/ldif/custom/50-bootstrap.ldif

Running the container alone gives this output:

$ docker run --name openldap-check -e LDAP_DOMAIN="example.com" -e LDAP_ADMIN_PASSWORD="secret" -v $PWD/spec/fixtures/ldap.ldif:/container/service/slapd/assets/config/bootstrap/ldif/custom/50-bootstrap.ldif osixia/openldap
*** CONTAINER_LOG_LEVEL = 3 (info)
*** Search service in CONTAINER_SERVICE_DIR = /container/service :
*** link /container/service/:ssl-tools/startup.sh to /container/run/startup/:ssl-tools
*** link /container/service/slapd/startup.sh to /container/run/startup/slapd
*** link /container/service/slapd/process.sh to /container/run/process/slapd/run
*** Set environment for startup files
*** Environment files will be proccessed in this order :
Caution: previously defined variables will not be overriden.
/container/environment/99-default/default.yaml
/container/environment/99-default/default.startup.yaml

To see how this files are processed and environment variables values,
run this container with '--loglevel debug'
*** Running /container/run/startup/:ssl-tools...
*** Running /container/run/startup/slapd...
Database and config directory are empty...
Init new ldap server...
invoke-rc.d: could not determine current runlevel
invoke-rc.d: policy-rc.d denied execution of stop.
  Backing up /etc/ldap/slapd.d in /var/backups/slapd-2.4.44+dfsg-5+deb9u1... done.
  Creating initial configuration... done.
  Creating LDAP directory... done.
invoke-rc.d: could not determine current runlevel
invoke-rc.d: policy-rc.d denied execution of start.
Start OpenLDAP...
Waiting for OpenLDAP to start...
Add bootstrap schemas...
config file testing succeeded
Add image bootstrap ldif...
Add custom bootstrap ldif...
sed: cannot rename /container/service/slapd/assets/config/bootstrap/ldif/custom/sedhdjBEe: Device or resource busy
*** /container/run/startup/slapd failed with status 4

*** Killing all processes...

Really struggling to figure this one out, short of doing as @doertedev has done. Any pointers would be much appreciated!

[fleporcq]

@jacobwalkr You must use command: --copy-service in your compose file

[agentS]

I am having the issue, as my bootstrap LDIF file is not mounted into the container when using docker-compose. However, starting the container works and I can do simple queries:

docker exec docker_openldap_1 ldapsearch -x -H ldap://127.0.0.1 -D "cn=admin,dc=springframework,dc=org" -w root -b "dc=springframework,dc=org"
# extended LDIF
#
# LDAPv3
# base <dc=springframework,dc=org> with scope subtree
# filter: (objectclass=*)
# requesting: ALL
#

# springframework.org
dn: dc=springframework,dc=org
objectClass: top
objectClass: dcObject
objectClass: organization
o: xxx
dc: springframework

# admin, springframework.org
dn: cn=admin,dc=springframework,dc=org
objectClass: simpleSecurityObject
objectClass: organizationalRole
cn: admin
description: LDAP administrator
userPassword:: e1NTSEF9OFJFNDYzbVNJQUt0UG9uL2J5ZmtuNk5rd0tZbzZ5NEk=

# search result
search: 2
result: 0 Success

# numResponses: 3
# numEntries: 2

Nevertheless, the entries defined in the file springDemo.ldif are never shown. The file contains a few example entries for thesting Spring LDAP:

dn: uid=joe,ou=otherpeople,dc=springframework,dc=org
objectclass: top
objectclass: person
objectclass: organizationalPerson
objectclass: inetOrgPerson
cn: Joe Smeth
sn: Smeth
uid: joe
userPassword: joespassword

The relevant parts of my docker compose file are shown below:

openldap:
  image: osixia/openldap:1.2.2
  restart: always
  command: --copy-service
  environment:
    - LDAP_ORGANISATION="FH-Hagenberg"
    - LDAP_DOMAIN="springframework.org"
    - LDAP_ADMIN_PASSWORD="root"
    #- LDAP_REMOVE_CONFIG_AFTER_SETUP="false"
  volumes:
    - "./ldapStorage:/var/lib/ldap"
    - "./ldapConfiguration:/etc/ldap/slapd.d"
    - "./ldapInitScripts/springDemo.ldif:/container/service/slapd/assets/config/bootstrap/ldif/custom/50-bootstrap.ldif"
volumes:
  data:
  ldapStorage:
  ldapConfiguration:

I am really struggling to get the container providing the demo data. I would be very grateful for your help. Thank you very much!

[agentS]

Apparently, the container has problems reading the file:

docker exec docker_openldap_1 ls -al /container/service/slapd/assets/config/bootstrap/ldif/custom/
ls: cannot access '/container/service/slapd/assets/config/bootstrap/ldif/custom/50-bootstrap.ldif': No such file or directory
total 16
drwxrwxr-x 1 root root 4096 Oct 11 06:31 .
drwxrwxr-x 1 root root 4096 May 15 07:30 ..
-????????? ? ?    ?       ?            ? 50-bootstrap.ldif
-rw-rw-r-- 1 root root  657 Mar  2  2018 README.md

[kanecta-richard]

I solved this problem in Kubernetes by adding the --copy-service arg:

containers:
- name: ldap
  image: osixia/openldap:1.2.1
  args: [ "--copy-service" ] 

This is what is recommended in https://github.com/osixia/docker-openldap/blob/stable/README.md#seed-ldap-database-with-ldif but I didn't know how to implement it. I found the answer in this example https://github.com/helm/charts/tree/master/stable/openldap which uses osixia/openldap.