osixia/openldap repository overview

⚠️ ⚠️ ⚠️ The stable tag will be removed in the coming weeks, please use the 1.5.0 tag instead.

⁠osixia/openldap 🐳🪪🌴

OpenLDAP⁠ container image with built-in bootstrap, backup helpers, TLS, replication and upgrade support.

110M+ pulls 🎉 Thanks to everyone using, testing, reporting issues, and contributing to this image. 🙏

• osixia/openldap 🐳🪪🌴⁠
  • ⚡ Quickstart⁠
  • 🛟 Backup / Restore⁠
  • 🔐 TLS⁠
  • 🔤 Environment Variables⁠
  • 📄 Documentation⁠
  • ⭐ Source Code⁠

⁠⚡ Quickstart

Run a basic OpenLDAP server:

docker run --name openldap --hostname ldap.example.org -p 389:3890 -p 636:6360 \
  -e OPENLDAP_BOOTSTRAP_ORGANIZATION="Keycloakers Org" \
  -e OPENLDAP_BOOTSTRAP_SUFFIX="dc=keycloakers,dc=org" \
  osixia/openldap

For persistent deployments, mount config, data, and backup directories:

docker run --name openldap --hostname ldap.example.org -p 389:3890 -p 636:6360 \
  -e OPENLDAP_BOOTSTRAP_ORGANIZATION="Keycloakers Org" \
  -e OPENLDAP_BOOTSTRAP_SUFFIX="dc=keycloakers,dc=org" \
  -v openldap-conf:/etc/openldap/slapd.d \
  -v openldap-data:/var/lib/openldap/openldap-data \
  -v openldap-backups:/var/lib/openldap/openldap-backups \
  osixia/openldap

Notes:

• Default internal listener ports are 3890 (LDAP) and 6360 (LDAPS), as defined by OPENLDAP_URLS.
• On first start, passwords are generated if hashed values are empty and printed in logs.
• Bootstrap runs only when config/data are empty.
• OPENLDAP_BOOTSTRAP_SUFFIX must start with dc= (for example dc=example,dc=org).

⁠🛟 Backup / Restore

The image includes the openldap-ctl helper with backup and restore commands.

Create a full backup:

docker exec openldap container run -- openldap-ctl backup my-backup

Create only a data backup and remove backups older than 15 days whose name starts with my-:

docker exec openldap container run -- openldap-ctl backup my-backup --data --clean 15 --clean-prefix my-

Without --clean-prefix, --clean removes all old backups in OPENLDAP_BACKUP_DIR. Other files are never removed.

This creates files in OPENLDAP_BACKUP_DIR:

• my-backup-config.gz
• my-backup-data.gz

Restore a backup:

docker exec openldap container run -- openldap-ctl restore my-backup --force

--force stops the OpenLDAP process if needed, replaces existing data in the target directories with the selected databases, then starts OpenLDAP again. Backup files are checked first: if one is missing or corrupted, nothing is stopped or deleted. If the restore fails, the previous data is put back.

The cron service is disabled by default. To schedule regular backups, run it in a separate container alongside OpenLDAP, sharing its configuration, data, and backup volumes:

docker run --name openldap-cron \
  -u root \
  -v openldap-conf:/etc/openldap/slapd.d \
  -v openldap-data:/var/lib/openldap/openldap-data \
  -v openldap-backups:/var/lib/openldap/openldap-backups \
  osixia/openldap -x openldap-cron

See the OPENLDAP_CRON_JOB environment variable to adjust the cron schedule and behavior.

⁠🔐 TLS

Set OPENLDAP_BOOTSTRAP_TLS=true to configure TLS during bootstrap.

The default certificate paths are:

• /container/services/openldap/assets/certs/tls.crt
• /container/services/openldap/assets/certs/tls.key
• /container/services/openldap/assets/certs/ca.crt

The simplest way is to mount a directory that contains files with exactly those names:

docker run --name openldap --hostname ldap.example.org -p 389:3890 -p 636:6360 \
  -e OPENLDAP_BOOTSTRAP_TLS=true \
  -v $PWD/certs:/container/services/openldap/assets/certs \
  osixia/openldap

If you also set OPENLDAP_BOOTSTRAP_TLS_REQUIRED=true, bootstrap adds TLS-required access rules. That setting is stricter than plain TLS enablement and is intended for deployments where non-TLS client access should be rejected.

⁠🔤 Environment Variables

Core

Bootstrap

TLS

RefInt

PPolicy

Unique

MemberOf

Replication

⁠📄 Documentation

See full documentation and complete features list on osixia/openldap documentation⁠.

This image is based on osixia/baseimage⁠.

⁠⭐ Source Code

Browse source code and contribute to this project on GitHub⁠.