Docker image: no CI step starts the build image over a volume written by a released image #1183

Problem

The Docker image upgrades the instance on its volume when it starts. A container started from a newer image over a volume written by an older one runs upgrade --no-prompt --force before it starts the server (run.sh#L137-L175). The Installation Guide documents this as the way to upgrade a container (PR #1179, To Upgrade a Docker Container).

No CI step runs that road:

• Volumes are reused only between containers of the same build image: the secret volume test (build.yml#L640, #L675) and docker-test-replication.sh.
• Released images run only in the benchmark (build.yml#L847, #L1222), without a volume.
• A restart on the same image does reach upgrade, but on equal versions Upgrade.isVersionCanBeUpdated returns success before any task runs (Upgrade.java#L994-L999).

A regression in the upgrade on start, from 5.1.x to 5.2.0, would therefore stay green in every cell. This covers the upgrade tasks, the image scripts that run around them, and the health check over an upgraded volume.

Expected

Both Docker legs (Temurin and Alpine) bootstrap a volume with the latest released image of the same flavour. They then start the build image over that volume, and check that it reports healthy and serves the data. A sketch, as proposed in the review of PR #1179:

      - name: Docker test upgrade from a released image
        shell: bash
        run: |
          docker run -d --name test_upgrade --init -e ADD_BASE_ENTRY=--addBaseEntry \
            -v test_upgrade_data:/opt/opendj/data openidentityplatform/opendj:5.1.2
          timeout 5m bash -c 'until docker exec test_upgrade /opt/opendj/bin/ldapsearch --port 1389 --bindDN "cn=Directory Manager" --bindPassword password --baseDN dc=example,dc=com --searchScope base "(objectClass=*)" dn 2>/dev/null | grep -q "^dn: dc=example,dc=com"; do sleep 5; done'
          docker stop -t 60 test_upgrade && docker rm test_upgrade
          docker run -d --name test_upgrade --init -v test_upgrade_data:/opt/opendj/data "$IMAGE"
          timeout 10m bash -c 'until [ "$(docker inspect -f "{{.State.Health.Status}}" test_upgrade)" = healthy ]; do sleep 5; done'
          docker exec test_upgrade /opt/opendj/bin/ldapsearch --port 1389 --bindDN "cn=Directory Manager" --bindPassword password \
            --baseDN dc=example,dc=com --searchScope base "(objectClass=*)" dn | grep -q "^dn: dc=example,dc=com"

The first wait polls the base entry, not the health status. The 5.1.2 health check turned healthy before import-ldif had finished.

Notes

• A pinned 5.1.2 has to be bumped after each release. env.release_version already holds the name of the latest release (build.yml#L499-L501), so the step can start from openidentityplatform/opendj:${{ env.release_version }} (-alpine on the Alpine leg) and follow releases on its own.
• The step should print docker logs test_upgrade on failure, as the other Docker steps do.