DS Container
From Dogtag
Contents
Overview (Work in Progress)
This document describes the process to run DS in a container for use by PKI CA Container.
Creating DS Container
To create DS container from Fedora image:
$ docker run \ --name ds \ --hostname ds.example.com \ --tmpfs /tmp \ --tmpfs /run \ --volume /sys/fs/cgroup:/sys/fs/cgroup:ro \ --expose 10389 \ --expose 10636 \ --publish 389:10389 \ --publish 636:10636 \ --detach \ fedora:29 "/usr/sbin/init" $ docker exec ds mkdir -p /run/lock
To create DS instance:
$ docker exec ds dnf install -y 389-ds-base $ docker exec ds sh -c 'dscreate create-template | sed \ -e "s/;root_password = .*/root_password = Secret.123/g" \ -e "s/;suffix = .*/suffix = dc=example,dc=com/g" \ -e "s/;selinux = .*/selinux = False/g" \ -e "s/;port = .*/port = 10389/g" \ -e "s/;secure_port = .*/secure_port = 10636/g" \ > /root/ds.inf' $ docker exec ds dscreate from-file /root/ds.inf
Accessing DS Container
To execute LDAP commands:
$ ldapsearch -x -h $HOSTNAME -s base -b ""
To add LDAP entries for PKI:
$ ldapadd -h $HOSTNAME -x -D "cn=Directory Manager" -w Secret.123 << EOF dn: dc=example,dc=com objectClass: domain dc: example dn: dc=pki,dc=example,dc=com objectClass: domain dc: pki EOF
Removing DS Container
(Optional) To remove DS instance:
$ docker exec ds dsctl localhost remove --do-it
To remove DS container:
$ docker rm -f ds
Building DS Container Image (does not work)
Create the following Dockerfile:
FROM fedora:29 ENV container docker EXPOSE 10389 10636 RUN dnf install -y 389-ds-base RUN dscreate create-template | sed \ -e "s/;root_password = .*/root_password = Secret.123/g" \ -e "s/;suffix = .*/suffix = dc=example,dc=com/g" \ -e "s/;selinux = .*/selinux = False/g" \ -e "s/;port = .*/port = 10389/g" \ -e "s/;secure_port = .*/secure_port = 10636/g" \ > /root/ds.inf RUN dscreate from-file /root/ds.inf --containerised USER dirsrv CMD [ \ "/usr/sbin/ns-slapd", \ "-D", "/etc/dirsrv/slapd-localhost", \ "-i", "/var/run/dirsrv/slapd-localhost.pid" \ ]
To build DS container image:
$ docker build -t ds .
To create DS container:
$ docker run \ --name ds \ --publish 389:10389 \ --publish 636:10636 \ --rm \ ds
Currently it doesn't work. See https://pagure.io/389-ds-base/issue/50343.