diff --git a/CHANGELOG.md b/CHANGELOG.md index ba934608..e0c2a69d 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,8 +4,13 @@ All notable changes to this project will be documented in this file. The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/) and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.html). +## [1.2.4] - 2019-03-14 +### Fixed + - Excessive RAM usage on 1.2.2, increased 10x from 1.2.1 #242 + - Startup issue with 1.2.3 #283 + ## [1.2.3] - 2019-01-21 -+10M docker pulls 🎉🎉🎉 thanks to all contributors 💕 +10M+ docker pulls 🎉🎉🎉 thanks to all contributors 💕 ### Added - GCE statefulset #241 @@ -229,6 +234,7 @@ Environment variable LDAP_REPLICATION_HDB_SYNCPROV changed to LDAP_REPLICATION_D ## [0.10.0] - 2015-03-03 New version initial release, no changelog before this sorry. +[1.2.4]: https://github.com/osixia/docker-openldap/compare/v1.2.3...v1.2.4 [1.2.3]: https://github.com/osixia/docker-openldap/compare/v1.2.2...v1.2.3 [1.2.2]: https://github.com/osixia/docker-openldap/compare/v1.2.1...v1.2.2 [1.2.1]: https://github.com/osixia/docker-openldap/compare/v1.2.0...v1.2.1 diff --git a/Makefile b/Makefile index dcd14318..340ca134 100644 --- a/Makefile +++ b/Makefile @@ -1,5 +1,5 @@ NAME = osixia/openldap -VERSION = 1.2.3 +VERSION = 1.2.4 .PHONY: build build-nocache test tag-latest push push-latest release git-tag-version diff --git a/README.md b/README.md index 6955249a..c261cda8 100644 --- a/README.md +++ b/README.md @@ -4,7 +4,7 @@ ![Docker Stars](https://img.shields.io/docker/stars/osixia/openldap.svg) ![](https://images.microbadger.com/badges/image/osixia/openldap.svg) -Latest release: 1.2.3 - OpenLDAP 2.4.47 - [Changelog](CHANGELOG.md) | [Docker Hub](https://hub.docker.com/r/osixia/openldap/)  +Latest release: 1.2.4 - OpenLDAP 2.4.47 - [Changelog](CHANGELOG.md) | [Docker Hub](https://hub.docker.com/r/osixia/openldap/)  **A docker image to run OpenLDAP.** @@ -37,7 +37,7 @@ Latest release: 1.2.3 - OpenLDAP 2.4.47 - [Changelog](CHANGELOG.md) | [Docker H - [Link environment file](#link-environment-file) - [Make your own image or extend this image](#make-your-own-image-or-extend-this-image) - [Advanced User Guide](#advanced-user-guide) - - [Extend osixia/openldap:1.2.3 image](#extend-osixiaopenldap123-image) + - [Extend osixia/openldap:1.2.4 image](#extend-osixiaopenldap124-image) - [Make your own openldap image](#make-your-own-openldap-image) - [Tests](#tests) - [Kubernetes](#kubernetes) @@ -57,11 +57,11 @@ If you find this image useful here's how you can help: ## Quick Start Run OpenLDAP docker image: - docker run --name my-openldap-container --detach osixia/openldap:1.2.3 + docker run --name my-openldap-container --detach osixia/openldap:1.2.4 Do not forget to add the port mapping for both port 389 and 636 if you wish to access the ldap server from another machine. - docker run -p 389:389 -p 636:636 --name my-openldap-container --detach osixia/openldap:1.2.3 + docker run -p 389:389 -p 636:636 --name my-openldap-container --detach osixia/openldap:1.2.4 Either command starts a new container with OpenLDAP running inside. Let's make the first search in our LDAP container: @@ -97,7 +97,7 @@ It will create an empty ldap for the company **Example Inc.** and the domain **e By default the admin has the password **admin**. All those default settings can be changed at the docker command line, for example: docker run --env LDAP_ORGANISATION="My Company" --env LDAP_DOMAIN="my-company.com" \ - --env LDAP_ADMIN_PASSWORD="JonSn0w" --detach osixia/openldap:1.2.3 + --env LDAP_ADMIN_PASSWORD="JonSn0w" --detach osixia/openldap:1.2.4 #### Data persistence @@ -148,12 +148,12 @@ argument to entrypoint if you don't want to overwrite them. # single file example: docker run \ --volume ./bootstrap.ldif:/container/service/slapd/assets/config/bootstrap/ldif/50-bootstrap.ldif \ - osixia/openldap:1.2.3 --copy-service + osixia/openldap:1.2.4 --copy-service #directory example: docker run \ --volume ./ldif:/container/service/slapd/assets/config/bootstrap/ldif/custom \ - osixia/openldap:1.2.3 --copy-service + osixia/openldap:1.2.4 --copy-service ### Use an existing ldap database @@ -164,7 +164,7 @@ simply mount this directories as a volume to `/var/lib/ldap` and `/etc/ldap/slap docker run --volume /data/slapd/database:/var/lib/ldap \ --volume /data/slapd/config:/etc/ldap/slapd.d \ - --detach osixia/openldap:1.2.3 + --detach osixia/openldap:1.2.4 You can also use data volume containers. Please refer to: > [https://docs.docker.com/engine/tutorials/dockervolumes/](https://docs.docker.com/engine/tutorials/dockervolumes/) @@ -184,7 +184,7 @@ If you are looking for a simple solution to administrate your ldap server you ca #### Use auto-generated certificate By default, TLS is already configured and enabled, certificate is created using container hostname (it can be set by docker run --hostname option eg: ldap.example.org). - docker run --hostname ldap.my-company.com --detach osixia/openldap:1.2.3 + docker run --hostname ldap.my-company.com --detach osixia/openldap:1.2.4 #### Use your own certificate @@ -194,24 +194,24 @@ You can set your custom certificate at run time, by mounting a directory contain --env LDAP_TLS_CRT_FILENAME=my-ldap.crt \ --env LDAP_TLS_KEY_FILENAME=my-ldap.key \ --env LDAP_TLS_CA_CRT_FILENAME=the-ca.crt \ - --detach osixia/openldap:1.2.3 + --detach osixia/openldap:1.2.4 Other solutions are available please refer to the [Advanced User Guide](#advanced-user-guide) #### Disable TLS Add --env LDAP_TLS=false to the run command: - docker run --env LDAP_TLS=false --detach osixia/openldap:1.2.3 + docker run --env LDAP_TLS=false --detach osixia/openldap:1.2.4 ### Multi master replication Quick example, with the default config. #Create the first ldap server, save the container id in LDAP_CID and get its IP: - LDAP_CID=$(docker run --hostname ldap.example.org --env LDAP_REPLICATION=true --detach osixia/openldap:1.2.3) + LDAP_CID=$(docker run --hostname ldap.example.org --env LDAP_REPLICATION=true --detach osixia/openldap:1.2.4) LDAP_IP=$(docker inspect -f "{{ .NetworkSettings.IPAddress }}" $LDAP_CID) #Create the second ldap server, save the container id in LDAP2_CID and get its IP: - LDAP2_CID=$(docker run --hostname ldap2.example.org --env LDAP_REPLICATION=true --detach osixia/openldap:1.2.3) + LDAP2_CID=$(docker run --hostname ldap2.example.org --env LDAP_REPLICATION=true --detach osixia/openldap:1.2.4) LDAP2_IP=$(docker inspect -f "{{ .NetworkSettings.IPAddress }}" $LDAP2_CID) #Add the pair "ip hostname" to /etc/hosts on each containers, @@ -247,7 +247,7 @@ You may have some problems with mounted files on some systems. The startup scrip To fix that run the container with `--copy-service` argument : - docker run [your options] osixia/openldap:1.2.3 --copy-service + docker run [your options] osixia/openldap:1.2.4 --copy-service ### Debug @@ -256,11 +256,11 @@ Available levels are: `none`, `error`, `warning`, `info`, `debug` and `trace`. Example command to run the container in `debug` mode: - docker run --detach osixia/openldap:1.2.3 --loglevel debug + docker run --detach osixia/openldap:1.2.4 --loglevel debug See all command line options: - docker run osixia/openldap:1.2.3 --help + docker run osixia/openldap:1.2.4 --help ## Environment Variables @@ -326,7 +326,7 @@ Replication options: If you want to set this variable at docker run command add the tag `#PYTHON2BASH:` and convert the yaml in python: - docker run --env LDAP_REPLICATION_HOSTS="#PYTHON2BASH:['ldap://ldap.example.org','ldap://ldap2.example.org']" --detach osixia/openldap:1.2.3 + docker run --env LDAP_REPLICATION_HOSTS="#PYTHON2BASH:['ldap://ldap.example.org','ldap://ldap2.example.org']" --detach osixia/openldap:1.2.4 To convert yaml to python online: http://yaml-online-parser.appspot.com/ @@ -346,7 +346,7 @@ Other environment variables: Environment variables can be set by adding the --env argument in the command line, for example: docker run --env LDAP_ORGANISATION="My company" --env LDAP_DOMAIN="my-company.com" \ - --env LDAP_ADMIN_PASSWORD="JonSn0w" --detach osixia/openldap:1.2.3 + --env LDAP_ADMIN_PASSWORD="JonSn0w" --detach osixia/openldap:1.2.4 Be aware that environment variable added in command line will be available at any time in the container. In this example if someone manage to open a terminal in this container @@ -357,14 +357,14 @@ he will be able to read the admin password in clear text from environment variab For example if your environment files **my-env.yaml** and **my-env.startup.yaml** are in /data/ldap/environment docker run --volume /data/ldap/environment:/container/environment/01-custom \ - --detach osixia/openldap:1.2.3 + --detach osixia/openldap:1.2.4 Take care to link your environment files folder to `/container/environment/XX-somedir` (with XX < 99 so they will be processed before default environment files) and not directly to `/container/environment` because this directory contains predefined baseimage environment files to fix container environment (INITRD, LANG, LANGUAGE and LC_CTYPE). Note: the container will try to delete the **\*.startup.yaml** file after the end of startup files so the file will also be deleted on the docker host. To prevent that : use --volume /data/ldap/environment:/container/environment/01-custom**:ro** or set all variables in **\*.yaml** file and don't use **\*.startup.yaml**: docker run --volume /data/ldap/environment/my-env.yaml:/container/environment/01-custom/env.yaml \ - --detach osixia/openldap:1.2.3 + --detach osixia/openldap:1.2.4 #### Make your own image or extend this image @@ -372,13 +372,13 @@ This is the best solution if you have a private registry. Please refer to the [A ## Advanced User Guide -### Extend osixia/openldap:1.2.3 image +### Extend osixia/openldap:1.2.4 image If you need to add your custom TLS certificate, bootstrap config or environment files the easiest way is to extends this image. Dockerfile example: - FROM osixia/openldap:1.2.3 + FROM osixia/openldap:1.2.4 MAINTAINER Your Name ADD bootstrap /container/service/slapd/assets/config/bootstrap diff --git a/example/docker-compose.yml b/example/docker-compose.yml index 5b7b5aa9..ba646e75 100644 --- a/example/docker-compose.yml +++ b/example/docker-compose.yml @@ -1,7 +1,7 @@ version: '2' services: openldap: - image: osixia/openldap:1.2.3 + image: osixia/openldap:1.2.4 container_name: openldap environment: LDAP_LOG_LEVEL: "256" diff --git a/example/extend-osixia-openldap/Dockerfile b/example/extend-osixia-openldap/Dockerfile index 5bad1877..645a8f73 100644 --- a/example/extend-osixia-openldap/Dockerfile +++ b/example/extend-osixia-openldap/Dockerfile @@ -1,4 +1,4 @@ -FROM osixia/openldap:1.2.3 +FROM osixia/openldap:1.2.4 MAINTAINER Your Name ADD bootstrap /container/service/slapd/assets/config/bootstrap diff --git a/example/kubernetes/simple/ldap-deployment.yaml b/example/kubernetes/simple/ldap-deployment.yaml index 7fe7f0de..116735e0 100644 --- a/example/kubernetes/simple/ldap-deployment.yaml +++ b/example/kubernetes/simple/ldap-deployment.yaml @@ -13,7 +13,7 @@ spec: spec: containers: - name: ldap - image: osixia/openldap:1.2.3 + image: osixia/openldap:1.2.4 volumeMounts: - name: ldap-data mountPath: /var/lib/ldap diff --git a/example/kubernetes/using-secrets/gce-statefullset.yaml b/example/kubernetes/using-secrets/gce-statefullset.yaml index 3f23b292..78e43c4c 100644 --- a/example/kubernetes/using-secrets/gce-statefullset.yaml +++ b/example/kubernetes/using-secrets/gce-statefullset.yaml @@ -12,7 +12,7 @@ spec: spec: containers: - name: azaldap - image: osixia/openldap:1.2.3 + image: osixia/openldap:1.2.4 imagePullPolicy: IfNotPresent #command: ["/bin/bash","-c","while [ 1 = 1 ] ; do sleep 1; date; done"] ports: diff --git a/example/kubernetes/using-secrets/ldap-deployment.yaml b/example/kubernetes/using-secrets/ldap-deployment.yaml index 6f167e3c..9783b95e 100644 --- a/example/kubernetes/using-secrets/ldap-deployment.yaml +++ b/example/kubernetes/using-secrets/ldap-deployment.yaml @@ -13,7 +13,7 @@ spec: spec: containers: - name: ldap - image: osixia/openldap:1.2.3 + image: osixia/openldap:1.2.4 args: ["--copy-service"] volumeMounts: - name: ldap-data diff --git a/image/environment/default.startup.yaml b/image/environment/default.startup.yaml index 95d00050..1036a08f 100644 --- a/image/environment/default.startup.yaml +++ b/image/environment/default.startup.yaml @@ -57,9 +57,6 @@ KEEP_EXISTING_CONFIG: false # Remove config after setup LDAP_REMOVE_CONFIG_AFTER_SETUP: true -# Ulimit -LDAP_NOFILE: 1024 - # ssl-helper environment variables prefix LDAP_SSL_HELPER_PREFIX: ldap # ssl-helper first search config from LDAP_SSL_HELPER_* variables, before SSL_HELPER_* variables. diff --git a/image/environment/default.yaml b/image/environment/default.yaml index 60107def..74a88fbf 100644 --- a/image/environment/default.yaml +++ b/image/environment/default.yaml @@ -8,3 +8,6 @@ # General container configuration # see table 5.1 in http://www.openldap.org/doc/admin24/slapdconf2.html for the available log levels. LDAP_LOG_LEVEL: 256 + +# Ulimit +LDAP_NOFILE: 1024 \ No newline at end of file diff --git a/image/service/slapd/startup.sh b/image/service/slapd/startup.sh index 07f9ba34..75aa7b7e 100755 --- a/image/service/slapd/startup.sh +++ b/image/service/slapd/startup.sh @@ -401,6 +401,7 @@ EOF fi if [[ -f "$WAS_ADMIN_PASSWORD_SET" ]]; then + get_ldap_base_dn LDAP_CONFIG_PASSWORD_ENCRYPTED=$(slappasswd -s "$LDAP_CONFIG_PASSWORD") LDAP_ADMIN_PASSWORD_ENCRYPTED=$(slappasswd -s "$LDAP_ADMIN_PASSWORD") sed -i "s|{{ LDAP_CONFIG_PASSWORD_ENCRYPTED }}|${LDAP_CONFIG_PASSWORD_ENCRYPTED}|g" ${CONTAINER_SERVICE_DIR}/slapd/assets/config/admin-pw/ldif/06-root-pw-change.ldif diff --git a/test/test.bats b/test/test.bats index 45a97224..cf1073b0 100644 --- a/test/test.bats +++ b/test/test.bats @@ -19,6 +19,25 @@ load test_helper } +@test "ldapsearch database from created volumes" { + + rm -rf VOLUMES && mkdir -p VOLUMES/config VOLUMES/database + LDAP_CID=$(docker run -h ldap.example.org -e LDAP_TLS=false --volume $PWD/VOLUMES/database:/var/lib/ldap --volume $PWD/VOLUMES/config:/etc/ldap/slapd.d -d $NAME:$VERSION) + wait_process_by_cid $LDAP_CID slapd + run docker exec $LDAP_CID ldapsearch -x -h ldap.example.org -b dc=example,dc=org -D "cn=admin,dc=example,dc=org" -w admin + docker kill $LDAP_CID + [ "$status" -eq 0 ] + LDAP_CID=$(docker run -h ldap.example.org -e LDAP_TLS=false --volume $PWD/VOLUMES/database:/var/lib/ldap --volume $PWD/VOLUMES/config:/etc/ldap/slapd.d -d $NAME:$VERSION) + wait_process_by_cid $LDAP_CID slapd + run docker exec $LDAP_CID ldapsearch -x -h ldap.example.org -b dc=example,dc=org -D "cn=admin,dc=example,dc=org" -w admin + run docker exec $LDAP_CID chown -R $UID:$UID /var/lib/ldap /etc/ldap/slapd.d + docker kill $LDAP_CID + rm -rf VOLUMES + + [ "$status" -eq 0 ] + +} + @test "ldapsearch new database with strict TLS" { run_image -h ldap.example.org