From 2ba918acc040279f30008441e1079e47de2ce7b4 Mon Sep 17 00:00:00 2001
From: Valery Kharseko <vharseko@3a-systems.ru>
Date: Fri, 25 Sep 2026 06:48:42 +0000
Subject: [PATCH] [#1088] Let the Docker image start under an arbitrary uid in group 0 (#1091)
---
opendj-packages/opendj-docker/Dockerfile-alpine | 10 +++++++---
.github/workflows/build.yml | 28 ++++++++++++++++++++++++++++
opendj-packages/opendj-docker/Dockerfile | 10 +++++++---
3 files changed, 42 insertions(+), 6 deletions(-)
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index d408f79..7162289 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -542,6 +542,20 @@
timeout 3m bash -c 'until docker inspect --format="{{json .State.Health.Status}}" test_custom | grep -q \"healthy\"; do sleep 10; done'
docker exec test_custom 'sh' '-c' '/opt/opendj/bin/ldapsearch --hostname localhost --port 1636 --bindDN "cn=Directory Manager" --bindPassword custom_password --useSsl --trustAll --baseDN "dc=example,dc=com" --searchScope base "(objectClass=*)" 1.1'
docker kill test_custom
+ - name: Docker test arbitrary uid
+ # OpenShift runs a container under an arbitrary uid that is only in group 0 (#1088)
+ shell: bash
+ run: |
+ trap 'code=$?; echo "::group::container logs (test_uid)"; docker logs test_uid 2>&1 || true; echo "::endgroup::"; exit $code' ERR
+ uid=$((1000000000 + RANDOM))
+ docker run --rm -it -d --memory="512m" --user $uid:0 -e ADD_BASE_ENTRY="--addBaseEntry" --name=test_uid localhost:5000/${GITHUB_REPOSITORY,,}:${{ env.release_version }}
+ timeout 3m bash -c 'until docker inspect --format="{{json .State.Health.Status}}" test_uid | grep -q \"healthy\"; do sleep 10; done'
+ docker exec test_uid 'sh' '-c' "test \"\$(stat -c %u /opt/opendj/instance.loc)\" = $uid"
+ docker exec test_uid 'sh' '-c' '/opt/opendj/bin/ldapsearch --hostname localhost --port 1636 --bindDN "cn=Directory Manager" --bindPassword password --useSsl --trustAll --baseDN "dc=example,dc=com" --searchScope base "(objectClass=*)" 1.1'
+ docker restart test_uid
+ timeout 3m bash -c 'until docker inspect --format="{{json .State.Health.Status}}" test_uid | grep -q \"healthy\"; do sleep 10; done'
+ docker exec test_uid 'sh' '-c' '/opt/opendj/bin/ldapsearch --hostname localhost --port 1636 --bindDN "cn=Directory Manager" --bindPassword password --useSsl --trustAll --baseDN "dc=example,dc=com" --searchScope base "(objectClass=*)" 1.1'
+ docker kill test_uid
- name: Scan image for vulnerabilities (Trivy)
# trivy resolves the image from the local Docker daemon, so only the runner's
# linux/amd64 manifest is scanned; cache: false keeps the ~1GB trivy DBs from
@@ -694,6 +708,20 @@
timeout 3m bash -c 'until docker inspect --format="{{json .State.Health.Status}}" test_custom | grep -q \"healthy\"; do sleep 10; done'
docker exec test_custom 'sh' '-c' '/opt/opendj/bin/ldapsearch --hostname localhost --port 1636 --bindDN "cn=Directory Manager" --bindPassword custom_password --useSsl --trustAll --baseDN "dc=example,dc=com" --searchScope base "(objectClass=*)" 1.1'
docker kill test_custom
+ - name: Docker test arbitrary uid
+ # OpenShift runs a container under an arbitrary uid that is only in group 0 (#1088)
+ shell: bash
+ run: |
+ trap 'code=$?; echo "::group::container logs (test_uid)"; docker logs test_uid 2>&1 || true; echo "::endgroup::"; exit $code' ERR
+ uid=$((1000000000 + RANDOM))
+ docker run --rm -it -d --memory="1g" --user $uid:0 -e ADD_BASE_ENTRY="--addBaseEntry" --name=test_uid localhost:5000/${GITHUB_REPOSITORY,,}:${{ env.release_version }}-alpine
+ timeout 3m bash -c 'until docker inspect --format="{{json .State.Health.Status}}" test_uid | grep -q \"healthy\"; do sleep 10; done'
+ docker exec test_uid 'sh' '-c' "test \"\$(stat -c %u /opt/opendj/instance.loc)\" = $uid"
+ docker exec test_uid 'sh' '-c' '/opt/opendj/bin/ldapsearch --hostname localhost --port 1636 --bindDN "cn=Directory Manager" --bindPassword password --useSsl --trustAll --baseDN "dc=example,dc=com" --searchScope base "(objectClass=*)" 1.1'
+ docker restart test_uid
+ timeout 3m bash -c 'until docker inspect --format="{{json .State.Health.Status}}" test_uid | grep -q \"healthy\"; do sleep 10; done'
+ docker exec test_uid 'sh' '-c' '/opt/opendj/bin/ldapsearch --hostname localhost --port 1636 --bindDN "cn=Directory Manager" --bindPassword password --useSsl --trustAll --baseDN "dc=example,dc=com" --searchScope base "(objectClass=*)" 1.1'
+ docker kill test_uid
- name: Scan image for vulnerabilities (Trivy)
# trivy resolves the image from the local Docker daemon, so only the runner's
# linux/amd64 manifest is scanned; cache: false keeps the ~1GB trivy DBs from
diff --git a/opendj-packages/opendj-docker/Dockerfile b/opendj-packages/opendj-docker/Dockerfile
index 9181389..e84ce54 100644
--- a/opendj-packages/opendj-docker/Dockerfile
+++ b/opendj-packages/opendj-docker/Dockerfile
@@ -56,11 +56,15 @@
&& groupadd $OPENDJ_USER \
&& useradd -m -r -u 1001 -g $OPENDJ_USER $OPENDJ_USER \
&& install -d -o $OPENDJ_USER /opt/opendj/data \
- && chown -R $OPENDJ_USER:$OPENDJ_USER /opt/opendj \
+ && chown -R $OPENDJ_USER:0 /opt/opendj \
&& chmod -R g=u /opt/opendj
-COPY --chown=$OPENDJ_USER:$OPENDJ_USER bootstrap/ /opt/opendj/bootstrap/
-COPY --chown=$OPENDJ_USER:$OPENDJ_USER run.sh /opt/opendj/run.sh
+# The RUN above gives /opt/opendj to group 0 rather than to the group of OPENDJ_USER, and
+# lets that group do what the owner does: OpenShift runs a container under an arbitrary uid
+# that is only in group 0, and that uid still has to write instance.loc and the instance
+# root. The scripts copied below are only read and run, so they just keep the same group.
+COPY --chown=$OPENDJ_USER:0 bootstrap/ /opt/opendj/bootstrap/
+COPY --chown=$OPENDJ_USER:0 run.sh /opt/opendj/run.sh
RUN chmod +x /opt/opendj/run.sh /opt/opendj/bootstrap/setup.sh /opt/opendj/bootstrap/replicate.sh
diff --git a/opendj-packages/opendj-docker/Dockerfile-alpine b/opendj-packages/opendj-docker/Dockerfile-alpine
index 5f2635f..bb47092 100644
--- a/opendj-packages/opendj-docker/Dockerfile-alpine
+++ b/opendj-packages/opendj-docker/Dockerfile-alpine
@@ -60,11 +60,15 @@
&& addgroup -S $OPENDJ_USER \
&& adduser -S -u 1001 -G $OPENDJ_USER $OPENDJ_USER \
&& install -d -o $OPENDJ_USER /opt/opendj/data \
- && chown -R $OPENDJ_USER:$OPENDJ_USER /opt/opendj \
+ && chown -R $OPENDJ_USER:0 /opt/opendj \
&& chmod -R g=u /opt/opendj
-COPY --chown=$OPENDJ_USER:$OPENDJ_USER bootstrap/ /opt/opendj/bootstrap/
-COPY --chown=$OPENDJ_USER:$OPENDJ_USER run.sh /opt/opendj/run.sh
+# The RUN above gives /opt/opendj to group 0 rather than to the group of OPENDJ_USER, and
+# lets that group do what the owner does: OpenShift runs a container under an arbitrary uid
+# that is only in group 0, and that uid still has to write instance.loc and the instance
+# root. The scripts copied below are only read and run, so they just keep the same group.
+COPY --chown=$OPENDJ_USER:0 bootstrap/ /opt/opendj/bootstrap/
+COPY --chown=$OPENDJ_USER:0 run.sh /opt/opendj/run.sh
RUN chmod +x /opt/opendj/run.sh /opt/opendj/bootstrap/setup.sh /opt/opendj/bootstrap/replicate.sh
--
Gitblit v1.10.0