OpenIdentityPlatform/OpenDJ

Problem The image cannot start under an arbitrary UID with GID 0, which is how OpenShift runs containers under its default restricted-v2 SCC. So the OpenShift template (opendj-packages/opendj-openshift-template) only works where the project grants anyuid. Both Dockerfiles give /opt/opendj to the opendj user and group and then copy the owner's permissions to the group (Dockerfile#L56-L60, Dockerfile-alpine#L60-L64): chown -R $OPENDJ_USER:$OPENDJ_USER /opt/opendj && chmod -R g=u /opt/opendj g=u only helps a process that is in the group owning the files. An OpenShift UID is in group 0 (root), not opendj. It cannot write /opt/opendj, where run.sh writes instance.loc and the scripts create tmp/. Reproduced with openidentityplatform/opendj:latest (2026-07-17): $ docker run --rm --entrypoint ls openidentityplatform/opendj:latest -ld /opt/opendj drwxrwxr-x 1 opendj opendj 4096 Jul 17 14:36 /opt/opendj $ docker run -d --name ocp --user 1000650000:0 -e ROOT_PASSWORD=secret123 openidentityplatfo

Problem When a container is started with MASTER_SERVER and OPENDJ_REPLICATION_TYPE, bootstrap/replicate.sh prints its whole environment to stdout before it sets up replication (replicate.sh#L23-L24): # Comment out echo "replicate ENV vars:" env ROOT_PASSWORD is part of that environment, so the Directory Manager password ends up in the container log. The log is exactly where it should not be: docker logs, kubectl logs and whatever log shipper collects them. Reproduced with openidentityplatform/opendj:latest (2026-07-17): docker network create djnet docker run -d --name dj0 --hostname dj0 --network djnet -e ROOT_PASSWORD=secret123 openidentityplatform/opendj:latest # wait for "OpenDJ is started" in the dj0 log docker run -d --name dj1 --hostname dj1 --network djnet -e ROOT_PASSWORD=secret123 \ -e MASTER_SERVER=dj0 -e OPENDJ_REPLICATION_TYPE=simple openidentityplatform/opendj:latest docker logs dj1 | grep ROOT_PASSWORD # ROOT_PASSWORD=secret123 Expected No secret reaches the log. The d