osixia/openldap repository overview

⚠️ ⚠️ ⚠️ The stable tag will be removed in the coming weeks, please use the 1.5.0 tag instead.

⁠osixia/openldap 🐳🪪🌴

OpenLDAP⁠ container image with built-in bootstrap, TLS, replication, backup helpers, and upgrade support.

110M+ pulls 🎉 Thanks to everyone using, testing, reporting issues, and contributing to this image. 🙏

• osixia/openldap 🐳🪪🌴⁠
  • ⚡ Quickstart⁠
  • 🛟 Backup / Restore⁠
  • 🔐 TLS⁠
  • 🔤 Environment Variables⁠
  • 📄 Documentation⁠
  • ⭐ Source Code⁠

⁠⚡ Quickstart

Run a basic OpenLDAP server:

docker run --name openldap --hostname ldap.example.org -p 389:3890 -p 636:6360 \
  -e OPENLDAP_BOOTSTRAP_ORGANIZATION="Keycloakers Org" \
  -e OPENLDAP_BOOTSTRAP_SUFFIX="dc=keycloakers,dc=org" \
  osixia/openldap

For persistent deployments, mount config, data, and backup directories:

docker run --name openldap --hostname ldap.example.org -p 389:3890 -p 636:6360 \
  -e OPENLDAP_BOOTSTRAP_ORGANIZATION="Keycloakers Org" \
  -e OPENLDAP_BOOTSTRAP_SUFFIX="dc=keycloakers,dc=org" \
  -v openldap-conf:/etc/openldap/slapd.d \
  -v openldap-data:/var/lib/openldap/openldap-data \
  -v openldap-backups:/var/lib/openldap/openldap-backups \
  osixia/openldap

Notes:

• Default internal listener ports are 3890 (LDAP) and 6360 (LDAPS), as defined by OPENLDAP_URLS.
• On first start, passwords are generated if hashed values are empty and printed in logs.
• Bootstrap runs only when config/data are empty.

A successful response returns the organization entry and the cn=admin account.

⁠🛟 Backup / Restore

The image includes the openldap-ctl helper with backup and restore commands.

Create a full backup:

docker exec openldap container run -- openldap-ctl backup my-backup

Create only a data backup and remove files older than 15 days:

docker exec openldap container run -- openldap-ctl backup my-backup --data --clean 15

This creates files in OPENLDAP_BACKUP_DIR:

• my-backup-config.gz
• my-backup-data.gz

Restore a backup:

docker exec openldap container run -- openldap-ctl restore my-backup --force

--force stops the OpenLDAP process if needed, deletes existing data in the target directories, restores the selected databases, then starts OpenLDAP again.

You can also run a cron service to automatically perform regular backups:

docker run --name openldap-cron \
  -u root \
  -v openldap-conf:/etc/openldap/slapd.d \
  -v openldap-data:/var/lib/openldap/openldap-data \
  -v openldap-backups:/var/lib/openldap/openldap-backups \
  osixia/openldap -x openldap-cron

See the OPENLDAP_CRON_JOB environment variable to adjust the cron schedule and behavior.

⁠🔐 TLS

Set OPENLDAP_BOOTSTRAP_TLS=true to configure TLS during bootstrap.

The default certificate paths are:

• /container/services/openldap/assets/certs/cert.crt
• /container/services/openldap/assets/certs/cert.key
• /container/services/openldap/assets/certs/ca.crt

The simplest way is to mount a directory that contains files with exactly those names:

docker run --name openldap --hostname ldap.example.org -p 389:3890 -p 636:6360 \
  -e OPENLDAP_BOOTSTRAP_TLS=true \
  -v $PWD/certs:/container/services/openldap/assets/certs \
  osixia/openldap

If you also set OPENLDAP_BOOTSTRAP_TLS_REQUIRED=true, bootstrap adds TLS-required access rules. That setting is stricter than plain TLS enablement and is intended for deployments where non-TLS client access should be rejected.

⁠🔤 Environment Variables

Core

Bootstrap

TLS

RefInt

PPolicy

Unique

MemberOf

Replication

Helpers and Maintenance

⁠📄 Documentation

See full documentation and complete features list on osixia/openldap documentation⁠.

This image is based on osixia/baseimage⁠.

⁠⭐ Source Code

Browse source code and contribute to this project on GitHub⁠.