osixia/openldap: an OpenLDAP container image with bootstrap, backup, TLS and replication

The default branch is the deprecated line

The readme opens with a warning that v2 is a breaking release. Existing v1 deployments are not migrated automatically and require a manual migration to move to v2, and automatic upgrade paths are intended only between future v2 versions, for example v2.x to v2.y.

The newest release on record is 2.6.15-rc from 2026-10-27, after 2.6.15-beta on 2026-10-16 and 2.6.15-alpha on 2026-10-07, and every example command in the readme uses the osixia/openldap:2.6.15-rc tag. The Dockerfile builds on osixia/baseimage:alpine-2.1.0 and installs OpenLDAP 2.6.15-r0.

A dead badge and an issues link to the old repository name

The header of the readme links to the Docker Hub page and the GitHub repository and reports 110M+ pulls. Its table of contents lists Quickstart, Backup / Restore, TLS, Replication, an LDAP Toolkit (OpenLDAP utilities, LDIF validation, password helpers and schema-to-LDIF conversion), Environment Variables, Documentation, Contributing and License sections.

A startup race, documented down to the error text

The quick start documents how to confirm the server is up. Retrieve the generated admin password from the container logs, then search the base DN from inside the container:

docker logs openldap 2>&1 | grep -i password

A successful ldapsearch against ldap://localhost:3890 returns the organization entry, and the root DN cn=admin authenticates without requiring a directory entry.

The notes state the defaults plainly. The internal listener ports are 3890 (LDAP) and 6360 (LDAPS), as defined by OPENLDAP_URLS, and the examples map them to 389 and 636 on the host. On first start, passwords are generated if hashed values are empty and printed in logs. Bootstrap runs only when config and data are empty, and OPENLDAP_BOOTSTRAP_SUFFIX must start with dc=.

The make target that tags a name with itself

There is no Makefile at the repository root; the build is described by the Dockerfile. It builds on osixia/baseimage:alpine-2.1.0, creates an ldap user and group with UID and GID 911 through the OPENLDAP_USER_UID and OPENLDAP_GROUP_GID build arguments, and installs the OpenLDAP 2.6.15-r0 packages: all backends, clients, all overlays, and the argon2, pbkdf2 and sha2 password modules. It then installs and links the container services, switches to the ldap user and exposes ports 3890 and 6360.

Two directories hold state, and you are told you may skip volumes

For persistent deployments the readme mounts three named volumes: openldap-conf at /etc/openldap/slapd.d, openldap-data at /var/lib/openldap/openldap-data and openldap-backups at /var/lib/openldap/openldap-backups. The same three volumes are shared with a separate cron container when you schedule backups.

The guide covers TLS, secrets, replication and Kubernetes

Setting OPENLDAP_BOOTSTRAP_TLS=true configures TLS during bootstrap. The default certificate paths are tls.crt, tls.key and ca.crt under /container/services/openldap/assets/certs, and the simplest approach is to mount a directory containing files with exactly those names. Setting OPENLDAP_BOOTSTRAP_TLS_REQUIRED=true also adds TLS-required access rules, intended for deployments where non-TLS client access should be rejected.

For debugging, the baseimage options --log-level debug --bash start an interactive shell, --skip-process starts the container without launching service processes, and OPENLDAP_DEBUG_LEVEL raises the slapd log level. Arguments after -- are forwarded to slapd.

The seeding section stops mid-word

To customise bootstrap configuration or initial data, the readme points to the custom LDIF documentation under services/openldap-bootstrap. For backups, the image includes the openldap-ctl helper. openldap-ctl backup my-backup writes my-backup-config.gz and my-backup-data.gz into OPENLDAP_BACKUP_DIR, and --data --clean 15 --clean-prefix my- limits it to data and removes backups older than 15 days whose name starts with my-. openldap-ctl restore my-backup --force checks the backup files first, and if the restore fails the previous data is put back. The cron service is disabled by default; scheduled backups run in a separate container started with -x openldap-cron.

Editorial conclusion

The image packages OpenLDAP 2.6.15 with bootstrap, backup and restore helpers, TLS and replication, and the readme documents verifying the server, debugging and scheduled backups. Two things decide whether to build on it now. v2 is a breaking release that requires a manual migration from v1 deployments, and the newest published release is 2.6.15-rc, a release candidate. On first start, generated passwords are printed in the container logs, so retrieve and protect them.

Frequently asked questions

Official sources

1. Issues
2. License: MIT
3. osixia/container-openldap on GitHub
4. README
5. Releases