See https://community.letsencrypt.org/t/cannot-verify-domain-with-openssl/11545

This is because OpenDKIM requires the private key to be writable only by the user opendkim and root.

But the postfix user is a member of the opendkim group, which triggers OpenDKIM (even if the key permissions are set to 0600).

We cannot remove postfix from opendkim group because it needs to access the Milter service running in /opendkim/opendkim.sock.

It would also be possible to chown opendkim:postfix /opendkim/opendkim.sock, but I don't know if it would solve the problem.

The fact is : the container runs as root, if it get compromised the private key will not be safe anyway.