Ack from me

congratulation @mreynolds for this tough investigations. Ack for me as well.

Just out of curiosity and for the recording. The problem being permission to access /dev/shm/dirsrv and /dev/shm/dirsrv/slapd-INST.
A discussed option were to create /dev/shm/dirsrv by systemd (solving reboot and selinux constraint) and /dev/shm/dirsrv/slapd-INST by the DS backend initialization.
Was this option failing as well or abandoned because of the urgency/risk to fix the issue or something else ?

congratulation @mreynolds for this tough investigations. Ack for me as well.
Just out of curiosity and for the recording. The problem being permission to access /dev/shm/dirsrv and /dev/shm/dirsrv/slapd-INST.
A discussed option were to create /dev/shm/dirsrv by systemd (solving reboot and selinux constraint) and /dev/shm/dirsrv/slapd-INST by the DS backend initialization.
Was this option failing as well or abandoned because of the urgency/risk to fix the issue or something else ?

No we just need to drop the entire /dev/shm/dirsrv/ approach. We should just allow the instance at start up to create /dev/shm/slapd-inst (once they make a new selinux rule for those directories). I had a community member on Debian also verify that this approach works correctly and doesn't cause anything strange to happen after reboots.

So once we get the new selinux labels created (bug is pending), then we can set the default to /dev/shm/slapd-inst in defaults.inf and we are done. No other changes will be needed.

congratulation @mreynolds for this tough investigations. Ack for me as well.
Just out of curiosity and for the recording. The problem being permission to access /dev/shm/dirsrv and /dev/shm/dirsrv/slapd-INST.
A discussed option were to create /dev/shm/dirsrv by systemd (solving reboot and selinux constraint) and /dev/shm/dirsrv/slapd-INST by the DS backend initialization.
Was this option failing as well or abandoned because of the urgency/risk to fix the issue or something else ?

No we just need to drop the entire /dev/shm/dirsrv/ approach. We should just allow the instance at start up to create /dev/shm/slapd-inst (once they make a new selinux rule for those directories). I had a community member on Debian also verify that this approach works correctly and doesn't cause anything strange to happen after reboots.
So once we get the new selinux labels created (bug is pending), then we can set the default to /dev/shm/slapd-inst in defaults.inf and we are done. No other changes will be needed.

Well we still need to do some container magic for cases where dscontainer is not used.

389-ds-base is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in 389-ds-base's github repository.

This pull request has been cloned to Github as issue and is available here:
- https://github.com/389ds/389-ds-base/issues/4091

If you want to continue to work on the PR, please navigate to the github issue,
download the patch from the attachments and file a new pull request.

Thank you for understanding. We apologize for all inconvenience.