Docker-openldap: Initial container start stalls before starting slapd when using docker-compose

[jerrac]

I can't get the container to finish the initialization of openldap when I use a docker-compose file. If I use the example docker run commands with no customization, it will complete.

Here is my setup:

• I cloned v1.2.1 (I also tried stable and v1.2.0) from here.
• Ran docker build --network host --build-arg LDAP_OPENLDAP_GID=1000 --build-arg LDAP_OPENLDAP_UID=1000 -t local_osixia_openldap .
• Moved to my docker compose project and ran docker-compose up -d.

My docker-compose.yml:

version: "3.3"

networks:
  osinet:
    driver: bridge
    driver_opts:
      com.docker.network.bridge.name: osinet

services:
  ldap:
    container_name: osi_ldap
    image: local_osixia_openldap
    command: --loglevel debug
    environment:
      # - LDAP_OPENLDAP_GID=1000 # leftover from when I was trying to set that without building.....
      # - LDAP_OPENLDAP_UID=1000
      - LDAP_ORGANISATION="My Org"
      - LDAP_DOMAIN="mydomain.com"
      - LDAP_ADMIN_PASSWORD="password"
    volumes:
      - type: bind
        source: ./data/ldap/var-lib-ldap
        target: /var/lib/ldap
      - type: bind
        source: ./data/ldap/etc-ldap-slap.d
        target: /etc/ldap/slap.d
    ports:
      - 127.0.0.1:3389:389
    networks:
      - osinet
    restart: "no"

Note: the ./data directories are owned, and grouped, by 1000.

My docker logs --follow osi_ldap output:

*** CONTAINER_LOG_LEVEL = 4 (debug)
*** Search service in CONTAINER_SERVICE_DIR = /container/service :
*** link /container/service/:ssl-tools/startup.sh to /container/run/startup/:ssl-tools
*** link /container/service/slapd/startup.sh to /container/run/startup/slapd
*** link /container/service/slapd/process.sh to /container/run/process/slapd/run
*** Set environment for startup files
*** ignore : LANG = en_US.UTF-8 (keep LANG = en_US.UTF-8 )
*** ignore : LANGUAGE = en_US.UTF-8 (keep LANGUAGE = en_US:en )
*** Environment files will be proccessed in this order : 
Caution: previously defined variables will not be overriden.
/container/environment/99-default/default.startup.yaml
/container/environment/99-default/default.yaml

*** --- process file : /container/environment/99-default/default.startup.yaml ---
*** ignore : LDAP_ORGANISATION = Example Inc. (keep LDAP_ORGANISATION = "My Org" )
*** ignore : LDAP_ADMIN_PASSWORD = admin (keep LDAP_ADMIN_PASSWORD = "password" )
*** ignore : LDAP_DOMAIN = example.org (keep LDAP_DOMAIN = "mydomain.com" )
*** --- process file : /container/environment/99-default/default.yaml ---
*** Run commands before startup...
*** Running /container/run/startup/:ssl-tools...
*** ------------ Environment dump ------------
*** LDAP_LOG_LEVEL = 256
*** SSL_HELPER_AUTO_RENEW_SERVICES_IMPACTED = slapd
*** LDAP_REPLICATION = False
*** LDAP_READONLY_USER_PASSWORD = readonly
*** LC_CTYPE = en_US.UTF-8
*** LDAP_ADMIN_PASSWORD = "password"
*** INITRD = no
*** LDAP_DOMAIN = "mydomain.com"
*** LDAP_REPLICATION_DB_SYNCPROV = binddn="cn=admin,$LDAP_BASE_DN" bindmethod=simple credentials="$LDAP_ADMIN_PASSWORD" searchbase="$LDAP_BASE_DN" type=refreshAndPersist interval=00:00:00:10 retry="60 +" timeout=1 starttls=critical
*** PATH = /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
*** LDAP_SSL_HELPER_PREFIX = ldap
*** LDAP_TLS_KEY_FILENAME = ldap.key
*** LDAP_TLS_VERIFY_CLIENT = demand
*** LANG = en_US.UTF-8
*** LDAP_READONLY_USER = False
*** CONTAINER_SERVICE_DIR = /container/service
*** LANGUAGE = en_US:en
*** LDAP_REPLICATION_HOSTS_ROW_1 = ldap://ldap.example.org
*** LDAP_REPLICATION_HOSTS_ROW_2 = ldap://ldap2.example.org
*** LDAP_READONLY_USER_USERNAME = readonly
*** LDAP_BASE_DN = 
*** HOME = /root
*** LDAP_BACKEND = mdb
*** LDAP_TLS = True
*** LDAP_ORGANISATION = "My Org"
*** CONTAINER_LOG_LEVEL = 4
*** LC_ALL = en_US.UTF-8
*** KEEP_EXISTING_CONFIG = False
*** LDAP_TLS_CRT_FILENAME = ldap.crt
*** LDAP_REMOVE_CONFIG_AFTER_SETUP = True
*** HOSTNAME = f5dbd3e91f6d
*** CONTAINER_STATE_DIR = /container/run/state
*** LDAP_TLS_CA_CRT_FILENAME = ca.crt
*** LDAP_REPLICATION_CONFIG_SYNCPROV = binddn="cn=admin,cn=config" bindmethod=simple credentials="$LDAP_CONFIG_PASSWORD" searchbase="cn=config" type=refreshAndPersist retry="60 +" timeout=1 starttls=critical
*** LDAP_RFC2307BIS_SCHEMA = False
*** LDAP_REPLICATION_HOSTS = #COMPLEX_BASH_ENV:TABLE: LDAP_REPLICATION_HOSTS_ROW_1 LDAP_REPLICATION_HOSTS_ROW_2
*** LDAP_CONFIG_PASSWORD = config
*** LDAP_TLS_CIPHER_SUITE = SECURE256:+SECURE128:-VERS-TLS-ALL:+VERS-TLS1.2:-RSA:-DHE-DSS:-CAMELLIA-128-CBC:-CAMELLIA-256-CBC
*** LDAP_TLS_ENFORCE = False
*** ------------------------------------------
*** Running /container/run/startup/slapd...
*** ------------ Environment dump ------------
*** LDAP_LOG_LEVEL = 256
*** SSL_HELPER_AUTO_RENEW_SERVICES_IMPACTED = slapd
*** LDAP_REPLICATION = False
*** LDAP_READONLY_USER_PASSWORD = readonly
*** LC_CTYPE = en_US.UTF-8
*** LDAP_ADMIN_PASSWORD = "password"
*** INITRD = no
*** PATH = /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
*** LDAP_REPLICATION_DB_SYNCPROV = binddn="cn=admin,$LDAP_BASE_DN" bindmethod=simple credentials="$LDAP_ADMIN_PASSWORD" searchbase="$LDAP_BASE_DN" type=refreshAndPersist interval=00:00:00:10 retry="60 +" timeout=1 starttls=critical
*** HOME = /root
*** LDAP_SSL_HELPER_PREFIX = ldap
*** LDAP_BASE_DN = 
*** LDAP_TLS_VERIFY_CLIENT = demand
*** LANG = en_US.UTF-8
*** LDAP_READONLY_USER = False
*** CONTAINER_SERVICE_DIR = /container/service
*** LANGUAGE = en_US:en
*** LDAP_REPLICATION_HOSTS_ROW_1 = ldap://ldap.example.org
*** LDAP_REPLICATION_HOSTS_ROW_2 = ldap://ldap2.example.org
*** LDAP_READONLY_USER_USERNAME = readonly
*** LDAP_TLS_KEY_FILENAME = ldap.key
*** LDAP_DOMAIN = "mydomain.com"
*** LDAP_REMOVE_CONFIG_AFTER_SETUP = True
*** LDAP_BACKEND = mdb
*** LDAP_TLS = True
*** LDAP_ORGANISATION = "My Org"
*** CONTAINER_LOG_LEVEL = 4
*** LC_ALL = en_US.UTF-8
*** KEEP_EXISTING_CONFIG = False
*** LDAP_TLS_CRT_FILENAME = ldap.crt
*** HOSTNAME = f5dbd3e91f6d
*** CONTAINER_STATE_DIR = /container/run/state
*** LDAP_TLS_CA_CRT_FILENAME = ca.crt
*** LDAP_REPLICATION_CONFIG_SYNCPROV = binddn="cn=admin,cn=config" bindmethod=simple credentials="$LDAP_CONFIG_PASSWORD" searchbase="cn=config" type=refreshAndPersist retry="60 +" timeout=1 starttls=critical
*** LDAP_RFC2307BIS_SCHEMA = False
*** LDAP_REPLICATION_HOSTS = #COMPLEX_BASH_ENV:TABLE: LDAP_REPLICATION_HOSTS_ROW_1 LDAP_REPLICATION_HOSTS_ROW_2
*** LDAP_CONFIG_PASSWORD = config
*** LDAP_TLS_CIPHER_SUITE = SECURE256:+SECURE128:-VERS-TLS-ALL:+VERS-TLS1.2:-RSA:-DHE-DSS:-CAMELLIA-128-CBC:-CAMELLIA-256-CBC
*** LDAP_TLS_ENFORCE = False
*** ------------------------------------------
Database and config directory are empty...
Init new ldap server...
invoke-rc.d: could not determine current runlevel
invoke-rc.d: policy-rc.d denied execution of stop.

From the non-cusomtized runs, I know that there should be output like Start OpenLDAP..., etc. after the last line I pasted above.

Even after waiting more than 10 minutes, docker logs show no more output, and any attempt to connect to slapd fails (as expected.)

I also ran into this same problem using osixia/openldap:latest.

I have not tried the customizations outside of docker-compose because of https://github.com/moby/moby/issues/23910#issuecomment-407555248

I am on Ubuntu 18.04.

Docker version 18.06.0-ce, build 0ffa825.

[plewin]

Hi @jerrac , I had a similar issue, I think the environment section of your docker compose is incorrect. Also try without quotes in env variables.

[jerrac]

@plewin Thank you! It worked!

[PureTryOut]

I've been trying things way too long only to find this issue after literal _hours_ and see that the problem was quotes around my environment variables :man_facepalming:

It would be great if the container could report this issue somehow instead of just stalling, it would save some people _a lot_ of time.

[obourdon]

@PureTryOut I am pretty sure that what you are asking for is impossible or at least very difficult to achieve. It seems to me like asking to bash/any shell/program to cope with potential user input mistakes. Only debugging can allow this from my perspective but I may very well be wrong ...