With FreeIPA in a container (https://github.com/adelton/docker-freeipa), the configuration and data produced by the versions of IPA and its components during initial ipa-server-install are stored in a volume. Files and directories stored on the volume are listed at

https://github.com/adelton/docker-freeipa/blob/master/volume-data-list

and they are symlinked from the image (for example, /var/lib/pki -> /data/var/lib/pki).

It is then possible to use image built with different (newer) version of IPA or even built on different OS (Fedora -> CentOS) and start new container with this new image, giving it volume populated with configuration and data files produced by the old container. At that point, upgrade process needs to be run to make the data and configuration match the versions of the software being started in the container.

In normal installation, upgrades are often achieved at rpm upgrade time, in %post scriptlets. That seems to be the case for pki-server as well so in

https://github.com/adelton/docker-freeipa/blob/master/ipa-server-configure-first#L49

in function upgrade_server we actually get the scriptlet from pki-server and run it verbatim. It merely seems to do

## NOTE:  At this time, NO attempt has been made to update ANY PKI subsystem
##        from EITHER 'sysVinit' OR previous 'systemd' processes to the new
##        PKI deployment process

echo "Upgrading server at `/bin/date`." >> /var/log/pki/pki-server-upgrade-10.2.1.log 2>&1
/sbin/pki-server-upgrade --silent >> /var/log/pki/pki-server-upgrade-10.2.1.log 2>&1
echo >> /var/log/pki/pki-server-upgrade-10.2.1.log 2>&1

systemctl daemon-reload

and it mostly works.

One issue we've hit is the difference in the packaging of resteasy. In /etc/sysconfig/pki-tomcat (which I'd consider part of instance configuration, so it lives in the volume (and it actually does not seem to exist before ipa-server-install is run, so it's not possible to just use the default value from the image)),

JAVA_OPTS="-DRESTEASY_LIB=/usr/share/java/resteasy"

is used to match the installation.

However, when pki-server-upgrade is run this file is not upgraded. Maybe it's related to the comment at the start of the scriptlet, that updates from old systemd processes are not supported?

We've workarounded this particular issue in the docker-freeipa's upgrade script but it'd be nice if Dogtag could provide for IPA upgrader a single generic tool (maybe pki-server-upgrade is it) which would handle upgrades completely, for reasonable mix of old / new versions, taking into account that with containers, people are likely to try wilder combinations than when the classical "I have my rpm-based machine, I upgrade with yum" setup is used.