|
1 |
| -FROM redhat/ubi9-minimal |
| 1 | +# vim:set ft=dockerfile: |
| 2 | +FROM ubuntu:noble |
2 | 3 |
|
3 |
| -# user 999/ group 999, that we want to use for compatibility with the ubuntu image. |
4 |
| -RUN groupadd --gid 999 -r mysql && \ |
5 |
| - useradd -r -g mysql mysql --home-dir /var/lib/mysql --uid 999 |
| 4 | +# add our user and group first to make sure their IDs get assigned consistently, regardless of whatever dependencies get added |
| 5 | +RUN groupadd -r mysql && useradd -r -g mysql mysql --home-dir /var/lib/mysql && userdel --remove ubuntu |
6 | 6 |
|
| 7 | +# add gosu for easy step-down from root |
| 8 | +# https://github.com/tianon/gosu/releases |
| 9 | +# gosu key is B42F6819007F00F88E364FD4036A9C25BF357DD4 |
7 | 10 | ENV GOSU_VERSION 1.17
|
| 11 | + |
| 12 | +ARG GPG_KEYS=177F4010FE56CA3336300305F1656F24C74CD1D8 |
| 13 | +# pub rsa4096 2016-03-30 [SC] |
| 14 | +# 177F 4010 FE56 CA33 3630 0305 F165 6F24 C74C D1D8 |
| 15 | +# uid [ unknown] MariaDB Signing Key <[email protected]> |
| 16 | +# sub rsa4096 2016-03-30 [E] |
| 17 | +# install "libjemalloc2" as it offers better performance in some cases. Use with LD_PRELOAD |
| 18 | +# install "pwgen" for randomizing passwords |
| 19 | +# install "tzdata" for /usr/share/zoneinfo/ |
| 20 | +# install "xz-utils" for .sql.xz docker-entrypoint-initdb.d files |
| 21 | +# install "zstd" for .sql.zst docker-entrypoint-initdb.d files |
| 22 | +# hadolint ignore=SC2086 |
8 | 23 | RUN set -eux; \
|
9 |
| - rpmArch="$(rpm --query --queryformat='%{ARCH}' rpm)"; \ |
10 |
| - case "$rpmArch" in \ |
11 |
| - aarch64) dpkgArch='arm64' ;; \ |
12 |
| - armv7*) dpkgArch='armhf' ;; \ |
13 |
| - i686) dpkgArch='i386' ;; \ |
14 |
| - ppc64le) dpkgArch='ppc64el' ;; \ |
15 |
| - s390x|riscv64) dpkgArch=$rpmArch ;; \ |
16 |
| - x86_64) dpkgArch='amd64' ;; \ |
17 |
| - *) echo >&2 "error: unknown/unsupported architecture '$rpmArch'"; exit 1 ;; \ |
18 |
| - esac; \ |
19 |
| - curl --fail --location --output /usr/local/bin/gosu https://github.com/tianon/gosu/releases/download/${GOSU_VERSION}/gosu-${dpkgArch} ; \ |
20 |
| - curl --fail --location --output /usr/local/bin/gosu.asc https://github.com/tianon/gosu/releases/download/${GOSU_VERSION}/gosu-${dpkgArch}.asc; \ |
| 24 | + apt-get update; \ |
| 25 | + DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \ |
| 26 | + ca-certificates \ |
| 27 | + gpg \ |
| 28 | + gpgv \ |
| 29 | + libjemalloc2 \ |
| 30 | + pwgen \ |
| 31 | + tzdata \ |
| 32 | + xz-utils \ |
| 33 | + zstd ; \ |
| 34 | + savedAptMark="$(apt-mark showmanual)"; \ |
| 35 | + apt-get install -y --no-install-recommends \ |
| 36 | + dirmngr \ |
| 37 | + gpg-agent \ |
| 38 | + wget; \ |
| 39 | + rm -rf /var/lib/apt/lists/*; \ |
| 40 | + dpkgArch="$(dpkg --print-architecture | awk -F- '{ print $NF }')"; \ |
| 41 | + wget -q -O /usr/local/bin/gosu "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$dpkgArch"; \ |
| 42 | + wget -q -O /usr/local/bin/gosu.asc "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$dpkgArch.asc"; \ |
21 | 43 | GNUPGHOME="$(mktemp -d)"; \
|
22 | 44 | export GNUPGHOME; \
|
23 | 45 | gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys B42F6819007F00F88E364FD4036A9C25BF357DD4; \
|
24 |
| - chmod a+x /usr/local/bin/gosu; \ |
| 46 | + for key in $GPG_KEYS; do \ |
| 47 | + gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key"; \ |
| 48 | + done; \ |
| 49 | + gpg --batch --export "$GPG_KEYS" > /etc/apt/trusted.gpg.d/mariadb.gpg; \ |
| 50 | + if command -v gpgconf >/dev/null; then \ |
| 51 | + gpgconf --kill all; \ |
| 52 | + fi; \ |
25 | 53 | gpg --batch --verify /usr/local/bin/gosu.asc /usr/local/bin/gosu; \
|
26 | 54 | gpgconf --kill all; \
|
27 | 55 | rm -rf "$GNUPGHOME" /usr/local/bin/gosu.asc; \
|
| 56 | + apt-mark auto '.*' > /dev/null; \ |
| 57 | + [ -z "$savedAptMark" ] || apt-mark manual $savedAptMark >/dev/null; \ |
| 58 | + apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \ |
| 59 | + chmod +x /usr/local/bin/gosu; \ |
28 | 60 | gosu --version; \
|
29 | 61 | gosu nobody true
|
30 | 62 |
|
31 |
| -COPY --chmod=0644 docker.cnf /etc/my.cnf.d/ |
32 |
| - |
33 |
| -COPY MariaDB.repo /etc/yum.repos.d/ |
| 63 | +RUN mkdir /docker-entrypoint-initdb.d |
34 | 64 |
|
35 |
| -# HasRequiredLabel requirement from Red Hat OpenShift Software Certification |
36 |
| -# https://access.redhat.com/documentation/en-us/red_hat_software_certification/2024/html/red_hat_openshift_software_certification_policy_guide/assembly-requirements-for-container-images_openshift-sw-cert-policy-introduction#con-image-metadata-requirements_openshift-sw-cert-policy-container-images |
37 |
| -LABEL name="MariaDB Server" \ |
38 |
| - vendor="MariaDB Community" \ |
39 |
| - version="11.5.2" \ |
40 |
| - release="Refer to Annotations org.opencontainers.image.{revision,source}" \ |
41 |
| - summary="MariaDB Database" \ |
42 |
| - description="MariaDB Database for relational SQL" |
| 65 | +# Ensure the container exec commands handle range of utf8 characters based of |
| 66 | +# default locales in base image (https://github.com/docker-library/docs/blob/135b79cc8093ab02e55debb61fdb079ab2dbce87/ubuntu/README.md#locales) |
| 67 | +ENV LANG C.UTF-8 |
43 | 68 |
|
44 | 69 | # OCI annotations to image
|
45 | 70 | LABEL org.opencontainers.image.authors="MariaDB Community" \
|
46 | 71 | org.opencontainers.image.title="MariaDB Database" \
|
47 | 72 | org.opencontainers.image.description="MariaDB Database for relational SQL" \
|
48 | 73 | org.opencontainers.image.documentation="https://hub.docker.com/_/mariadb/" \
|
49 |
| - org.opencontainers.image.base.name="docker.io/redhat/ubi9-minimal" \ |
| 74 | + org.opencontainers.image.base.name="docker.io/library/ubuntu:noble" \ |
50 | 75 | org.opencontainers.image.licenses="GPL-2.0" \
|
51 | 76 | org.opencontainers.image.source="https://github.com/MariaDB/mariadb-docker" \
|
52 | 77 | org.opencontainers.image.vendor="MariaDB Community" \
|
53 | 78 | org.opencontainers.image.version="11.5.2" \
|
54 | 79 | org.opencontainers.image.url="https://github.com/MariaDB/mariadb-docker"
|
55 | 80 |
|
56 | 81 | # bashbrew-architectures: amd64 arm64v8 ppc64le s390x
|
57 |
| -ARG MARIADB_VERSION=11.5.2 |
58 |
| -ENV MARIADB_VERSION=$MARIADB_VERSION |
59 |
| -# release-status:Stable |
60 |
| -# release-support-type:Short Term Support |
| 82 | +ARG MARIADB_VERSION=1:11.5.2+maria~ubu2404 |
| 83 | +ENV MARIADB_VERSION $MARIADB_VERSION |
| 84 | +# release-status:Unknown |
| 85 | +# release-support-type:Unknown |
61 | 86 | # (https://downloads.mariadb.org/rest-api/mariadb/)
|
62 | 87 |
|
63 |
| -# missing pwgen(epel), jemalloc(epel) (as entrypoint/user extensions) |
64 |
| -# procps, pv(epel) - missing dependencies of galera sst script |
65 |
| -# tzdata re-installed as only a fake version is part of the ubi-minimal base image. |
66 |
| -# FF8AD1344597106ECE813B918A3872BF3228467C is the Fedora RPM key |
67 |
| -# 177F4010FE56CA3336300305F1656F24C74CD1D8 is the MariaDB Server RPM key |
68 |
| -RUN set -eux ; \ |
69 |
| - curl --fail https://pagure.io/fedora-web/websites/raw/master/f/sites/getfedora.org/static/keys/FF8AD1344597106ECE813B918A3872BF3228467C.txt --output /tmp/epelkey.txt ; \ |
70 |
| - GNUPGHOME="$(mktemp -d)"; export GNUPGHOME ; \ |
71 |
| - gpg --batch --import /tmp/epelkey.txt ; \ |
72 |
| - gpg --batch --armor --export FF8AD1344597106ECE813B918A3872BF3228467C > /tmp/epelkey.txt ; \ |
73 |
| - rpmkeys --import /tmp/epelkey.txt ; \ |
74 |
| - curl --fail https://dl.fedoraproject.org/pub/epel/epel-release-latest-9.noarch.rpm --output /tmp/epel-release-latest-9.noarch.rpm ; \ |
75 |
| - rpm -K /tmp/epel-release-latest-9.noarch.rpm ; \ |
76 |
| - rpm -ivh /tmp/epel-release-latest-9.noarch.rpm ; \ |
77 |
| - rm /tmp/epelkey.txt /tmp/epel-release-latest-9.noarch.rpm ; \ |
78 |
| - curl --fail https://supplychain.mariadb.com/MariaDB-Server-GPG-KEY --output /tmp/MariaDB-Server-GPG-KEY ; \ |
79 |
| - gpg --batch --import /tmp/MariaDB-Server-GPG-KEY; \ |
80 |
| - gpg --batch --armor --export 177F4010FE56CA3336300305F1656F24C74CD1D8 > /tmp/MariaDB-Server-GPG-KEY ; \ |
81 |
| - rpmkeys --import /tmp/MariaDB-Server-GPG-KEY ; \ |
82 |
| - rm -rf "$GNUPGHOME" /tmp/MariaDB-Server-GPG-KEY ; \ |
83 |
| - unset GNUPGHOME ; \ |
84 |
| - microdnf update -y ; \ |
85 |
| - microdnf reinstall -y tzdata ; \ |
86 |
| - microdnf install -y procps-ng zstd xz jemalloc pwgen pv ; \ |
87 |
| - mkdir -p /etc/mysql/conf.d /etc/mysql/mariadb.conf.d/ /var/lib/mysql/mysql /run/mariadb /usr/lib64/galera ; \ |
88 |
| - chmod ugo+rwx,o+t /run/mariadb ; \ |
89 |
| - microdnf install -y MariaDB-backup-${MARIADB_VERSION} MariaDB-server-${MARIADB_VERSION} ; \ |
90 |
| - # compatibility with DEB Galera packaging |
91 |
| - ln -s /usr/lib64/galera-4/libgalera_smm.so /usr/lib/libgalera_smm.so ; \ |
92 |
| - # compatibility with RPM Galera packaging |
93 |
| - ln -s /usr/lib64/galera-4/libgalera_smm.so /usr/lib64/galera/libgalera_smm.so ; \ |
94 |
| - microdnf clean all ; \ |
95 |
| - rmdir /var/lib/mysql/mysql ; \ |
96 |
| - chown -R mysql:mysql /var/lib/mysql /run/mariadb ; \ |
97 |
| - mkdir /licenses ; \ |
98 |
| - ln -s /usr/share/doc/MariaDB-server-${MARIADB_VERSION}/COPYING /licenses/GPL-2 ; \ |
99 |
| - ln -s /usr/share/licenses /licenses/package-licenses ; \ |
100 |
| - ln -s Apache-2.0-license /licenses/gosu |
| 88 | +# Allowing overriding of REPOSITORY, a URL that includes suite and component for testing and Enterprise Versions |
| 89 | +ARG REPOSITORY="http://archive.mariadb.org/mariadb-11.5.2/repo/ubuntu/ noble main main/debug" |
101 | 90 |
|
102 |
| -VOLUME /var/lib/mysql |
| 91 | +RUN set -e;\ |
| 92 | + echo "deb ${REPOSITORY}" > /etc/apt/sources.list.d/mariadb.list; \ |
| 93 | + { \ |
| 94 | + echo 'Package: *'; \ |
| 95 | + echo 'Pin: release o=MariaDB'; \ |
| 96 | + echo 'Pin-Priority: 999'; \ |
| 97 | + } > /etc/apt/preferences.d/mariadb |
| 98 | +# add repository pinning to make sure dependencies from this MariaDB repo are preferred over Debian dependencies |
| 99 | +# libmariadbclient18 : Depends: libmysqlclient18 (= 5.5.42+maria-1~wheezy) but 5.5.43-0+deb7u1 is to be installed |
103 | 100 |
|
104 |
| -RUN mkdir /docker-entrypoint-initdb.d |
| 101 | +# the "/var/lib/mysql" stuff here is because the mysql-server postinst doesn't have an explicit way to disable the mysql_install_db codepath besides having a database already "configured" (ie, stuff in /var/lib/mysql/mysql) |
| 102 | +# also, we set debconf keys to make APT a little quieter |
| 103 | +# hadolint ignore=DL3015 |
| 104 | +RUN set -ex; \ |
| 105 | + { \ |
| 106 | + echo "mariadb-server" mysql-server/root_password password 'unused'; \ |
| 107 | + echo "mariadb-server" mysql-server/root_password_again password 'unused'; \ |
| 108 | + } | debconf-set-selections; \ |
| 109 | + apt-get update; \ |
| 110 | +# postinst script creates a datadir, so avoid creating it by faking its existance. |
| 111 | + mkdir -p /var/lib/mysql/mysql ; touch /var/lib/mysql/mysql/user.frm ; \ |
| 112 | +# mariadb-backup is installed at the same time so that `mysql-common` is only installed once from just mariadb repos |
| 113 | + apt-get install -y --no-install-recommends mariadb-server="$MARIADB_VERSION" mariadb-backup socat \ |
| 114 | + ; \ |
| 115 | + rm -rf /var/lib/apt/lists/*; \ |
| 116 | +# purge and re-create /var/lib/mysql with appropriate ownership |
| 117 | + rm -rf /var/lib/mysql; \ |
| 118 | + mkdir -p /var/lib/mysql /run/mysqld; \ |
| 119 | + chown -R mysql:mysql /var/lib/mysql /run/mysqld; \ |
| 120 | +# ensure that /run/mysqld (used for socket and lock files) is writable regardless of the UID our mysqld instance ends up having at runtime |
| 121 | + chmod 1777 /run/mysqld; \ |
| 122 | +# comment out a few problematic configuration values |
| 123 | + find /etc/mysql/ -name '*.cnf' -print0 \ |
| 124 | + | xargs -0 grep -lZE '^(bind-address|log|user\s)' \ |
| 125 | + | xargs -rt -0 sed -Ei 's/^(bind-address|log|user\s)/#&/'; \ |
| 126 | +# don't reverse lookup hostnames, they are usually another container |
| 127 | + printf "[mariadb]\nhost-cache-size=0\nskip-name-resolve\n" > /etc/mysql/mariadb.conf.d/05-skipcache.cnf; \ |
| 128 | +# Issue #327 Correct order of reading directories /etc/mysql/mariadb.conf.d before /etc/mysql/conf.d (mount-point per documentation) |
| 129 | + if [ -L /etc/mysql/my.cnf ]; then \ |
| 130 | +# 10.5+ |
| 131 | + sed -i -e '/includedir/ {N;s/\(.*\)\n\(.*\)/\n\2\n\1/}' /etc/mysql/mariadb.cnf; \ |
| 132 | + fi |
| 133 | + |
| 134 | + |
| 135 | +VOLUME /var/lib/mysql |
105 | 136 |
|
106 | 137 | COPY healthcheck.sh /usr/local/bin/healthcheck.sh
|
107 | 138 | COPY docker-entrypoint.sh /usr/local/bin/
|
108 |
| - |
109 | 139 | ENTRYPOINT ["docker-entrypoint.sh"]
|
110 | 140 |
|
111 |
| -USER mysql |
112 | 141 | EXPOSE 3306
|
113 | 142 | CMD ["mariadbd"]
|
0 commit comments