Docker image: the HEALTHCHECK binds with the initial ROOT_PASSWORD, so the container turns unhealthy once the root password is changed

[vharseko]

Problem

The image HEALTHCHECK binds as the root user with the password the container was started with (Dockerfile#L78):

HEALTHCHECK ... CMD test -f "$BOOTSTRAP_COMPLETE" && opendj/bin/ldapsearch ... --bindDN "$ROOT_USER_DN" --bindPassword "${ROOT_PASSWORD:-password}" ... --baseDN "" --searchScope base "(objectClass=*)" 1.1 || exit 1

ROOT_PASSWORD is only the initial root password (README: "Initial root user password"). Once an operator changes the Directory Manager password, which is what one is supposed to do with an initial password, every probe fails with 49 (Invalid Credentials) and the container becomes unhealthy for good, although the server serves normally.

Reproduced with openidentityplatform/opendj:latest (2026-07-17):

docker run -d --name hc --health-interval=5s -e ROOT_PASSWORD=secret123 openidentityplatform/opendj:latest
# wait until healthy
docker exec hc /opt/opendj/bin/ldappasswordmodify -h localhost -p 1389 \
  -D "cn=Directory Manager" -w secret123 -c secret123 -n rotated456
# The LDAP password modify operation was successful
docker inspect -f '{{.State.Health.Status}}' hc
# unhealthy   (last probe: 1 The LDAP search request failed: 49 (Invalid Credentials))

A second effect of the same line: every 30 s the probe puts the password on a command line, so it is readable from /proc/<pid>/cmdline of the probe's sh and java processes while it runs (seen in the container above).

Expected

The health check does not depend on a credential that the operator is expected to change, and passes no password on a command line.

The probe reads the root DSE with attribute list 1.1, which needs no bind: an anonymous search of the same entry succeeds on a default instance (ldapsearch -h localhost -p 1636 -Z -X -b "" -s base "(objectClass=*)" 1.1 returns dn: and exit code 0). The readiness part (the instance is bootstrapped, #898) is carried by the $BOOTSTRAP_COMPLETE marker, not by the bind.

Notes

• If an anonymous probe is not acceptable (an instance configured to reject unauthenticated requests), a bind-less alternative is needed, e.g. an LDAPS connect only; a bind must not be the default.
• Kubernetes ignores the image HEALTHCHECK, so a Helm chart (discussion Add an official Helm chart so OpenDJ can be deployed on any Kubernetes cluster #1079) will define its own probes; they should follow whatever is chosen here.
• Related: Docker image: replicate.sh prints its environment, ROOT_PASSWORD included, to the container log #1084 (replicate.sh prints ROOT_PASSWORD to the log).