Fix ldap-init race on first-run setup #266

2026-11-09T10:40:04Z

raucao commented

2026-11-09 10:40:04 +00:00

The 389ds image healthcheck (dscontainer -H) only validates the LDAPI socket. On an empty volume, instance setup runs a temporary slapd that exposes LDAPI but not TCP 3389, so Docker marked the ldap service healthy too early. That let ldap-init start before the real slapd was listening, failing with "Can't contact LDAP server - 107 - Socket not connected".

Override the healthcheck to probe the real TCP listener and bind as cn=Directory Manager with the configured password, and add a bounded wait loop to ldap-init so it retries until the server is reachable.

The 389ds image healthcheck (dscontainer -H) only validates the LDAPI socket. On an empty volume, instance setup runs a temporary slapd that exposes LDAPI but not TCP 3389, so Docker marked the ldap service healthy too early. That let ldap-init start before the real slapd was listening, failing with "Can't contact LDAP server - 107 - Socket not connected". Override the healthcheck to probe the real TCP listener and bind as `cn=Directory Manager` with the configured password, and add a bounded wait loop to ldap-init so it retries until the server is reachable.

raucao added the bug dev environment labels 2026-11-09 10:42:21 +00:00

raucao force-pushed raucao/ldap-init-race from 6838fc46ad to e744a9e167

2026-11-09 10:43:43 +00:00

Compare

raucao force-pushed raucao/ldap-init-race from e744a9e167 to fd14b69e5a

2026-11-09 10:44:29 +00:00

Compare

raucao requested review from greg 2026-11-09 11:19:47 +00:00

raucao added the kredits-1 label 2026-11-09 11:19:58 +00:00

greg approved these changes

2026-11-09 13:35:58 +00:00

greg left a comment

Just ran it from a clean slate, I can confirm this work 👍

🎉 1

raucao added 1 commit 2026-11-09 16:12:26 +00:00

Fix ldap-init race on first-run setup

CI / Test (pull_request) Successful in 45s

Details

Release Drafter / Update release notes draft (pull_request) Failing after 3s

Details

382900521b

The 389ds image healthcheck (dscontainer -H) only validates the LDAPI
socket. On an empty volume, instance setup runs a temporary slapd that
exposes LDAPI but not TCP 3389, so Docker marked the ldap service
healthy too early. That let ldap-init start before the real slapd was
listening, failing with "Can't contact LDAP server - 107 - Socket not
connected".

Override the healthcheck to probe the real TCP listener and bind as
cn=Directory Manager with the configured password, and add a bounded
wait loop to ldap-init so it retries until the server is reachable.

raucao force-pushed raucao/ldap-init-race from fd14b69e5a to 382900521b

2026-11-09 16:12:26 +00:00

Compare

raucao merged commit f8d6fcb3d2 into master

2026-11-09 16:19:28 +00:00

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: kosmos/akkounts#266