A minimal, self-maintained OpenLDAP (slapd) image
built on debian:trixie-slim.
- Nothing environment-specific is baked into the image. The suffix, admin password and directory data are all supplied at runtime.
- On first run the entrypoint configures
slapdfrom the environment (Debian's owndpkg-reconfiguregenerates a correctcn=config+mdbdatabase) and creates an optional read-only bind account. - On later runs it simply starts
slapdagainst the persisted volumes.
| Variable | Required | Default | Description |
|---|---|---|---|
LDAP_DOMAIN |
yes | — | DNS domain; the base DN is derived from it (example.com → dc=example,dc=com). |
LDAP_ADMIN_PASSWORD |
yes | — | Password for cn=admin,<base DN>. |
LDAP_ORGANISATION |
no | LDAP_DOMAIN |
Organisation name for the base entry. |
LDAP_READONLY_USER |
no | — | If set (with the password), create cn=<user>,<base DN> as a read-only bind account. |
LDAP_READONLY_PASSWORD |
no | — | Password for the read-only account. |
LDAP_LOG_LEVEL |
no | 256 |
slapd log level (see slapd.conf(5)). |
| Path | Purpose |
|---|---|
/etc/ldap/slapd.d |
cn=config (dynamic configuration) |
/var/lib/ldap |
mdb database (directory data) |
389/tcp — plaintext LDAP, intended for a private container network.
docker run -d --name openldap \
-e LDAP_DOMAIN=example.com \
-e LDAP_ADMIN_PASSWORD=change-me \
-e LDAP_READONLY_USER=readonly \
-e LDAP_READONLY_PASSWORD=change-me-too \
-v openldap-config:/etc/ldap/slapd.d \
-v openldap-data:/var/lib/ldap \
-p 389:389 \
ghcr.io/kozlek/openldap:latestImages are published to ghcr.io/kozlek/openldap. The tag encodes the bundled
OpenLDAP version, and — for releases — the semver release it was cut from:
| Tag | Example | Meaning |
|---|---|---|
<openldap>-<release> |
2.6.10-1.0.0 |
Immutable: a specific release build. Pin this. |
<openldap> |
2.6.10 |
Floating: newest build of that OpenLDAP version. |
<major.minor> |
2.6 |
Floating: newest build of that OpenLDAP minor. |
latest |
— | Floating: newest build overall. |
To load an existing directory, export it to LDIF (entries and userPassword
hashes, without operational attributes) and import it into the running container
with ldapadd:
docker exec -i openldap \
ldapadd -x -D "cn=admin,<base DN>" -w "<admin password>" < export.ldifWhen importing from another OpenLDAP server, userPassword hashes are carried
over verbatim — no password resets.
New and not yet battle-tested — build and validate before relying on it.
MIT — see LICENSE.