The 389ds image healthcheck (dscontainer -H) only validates the LDAPI
socket. On an empty volume, instance setup runs a temporary slapd that
exposes LDAPI but not TCP 3389, so Docker marked the ldap service
healthy too early. That let ldap-init start before the real slapd was
listening, failing with "Can't contact LDAP server - 107 - Socket not
connected".
Override the healthcheck to probe the real TCP listener and bind as
cn=Directory Manager with the configured password, and add a bounded
wait loop to ldap-init so it retries until the server is reachable.
raucao