If you generate a key by running a command in a container, and if that container is set up to log data to some central logging system, then it can be possible to set up a situation where private keys leak out through the logs.

The command is ovpn_getclient, which puts data out to standard out:

% docker run -v ovpn-data-t2:/etc/openvpn --rm kylemanna/openvpn ovpn_getclient USER > USER.ovpn

The logging system I'm using is gliderlabs/logspout, which is configured to send stdout and stderr for running containers into a central syslog system. Since ovpn_getclient does its thing through stdout, that data is logged through the standard Docker logging driver.

The simple fix I can see is to run the command in some way with logging disabled for that run, e.g.

docker run -v ovpn-data-t2:/etc/openvpn --log-driver=none --rm kylemanna/openvpn ovpn_getclient USER > USER.ovpn

of course that's also substandard because you're really wanting to generate some kind of a log when the client file is generated, but I can confirm that this didn't exit unwanted data to syslog.

The word of warning is that ovpn_getclient might generate some logs somewhere, and it would be good to look carefully to make sure they don't go somewhere unwanted.