From a6f4c23621421bb708ad44616532d3d1cf44f6bf Mon Sep 17 00:00:00 2001 From: Tianon Gravi Date: Fri, 15 Apr 2016 16:25:40 -0700 Subject: [PATCH] Allow arbitrary --user values --- 5.5/Dockerfile | 28 +++++++++++++++++++++++----- 5.5/docker-entrypoint.sh | 19 ++++++++++++++----- 5.6/Dockerfile | 19 ++++++++++++++++++- 5.6/docker-entrypoint.sh | 19 ++++++++++++++----- 5.7/Dockerfile | 19 ++++++++++++++++++- 5.7/docker-entrypoint.sh | 17 +++++++++++++---- 6 files changed, 100 insertions(+), 21 deletions(-) diff --git a/5.5/Dockerfile b/5.5/Dockerfile index ae8c5eb07..97fe4b257 100644 --- a/5.5/Dockerfile +++ b/5.5/Dockerfile @@ -3,6 +3,20 @@ FROM debian:jessie # add our user and group first to make sure their IDs get assigned consistently, regardless of whatever dependencies get added RUN groupadd -r mysql && useradd -r -g mysql mysql +# add gosu for easy step-down from root +ENV GOSU_VERSION 1.7 +RUN set -x \ + && apt-get update && apt-get install -y --no-install-recommends ca-certificates wget && rm -rf /var/lib/apt/lists/* \ + && wget -O /usr/local/bin/gosu "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$(dpkg --print-architecture)" \ + && wget -O /usr/local/bin/gosu.asc "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$(dpkg --print-architecture).asc" \ + && export GNUPGHOME="$(mktemp -d)" \ + && gpg --keyserver ha.pool.sks-keyservers.net --recv-keys B42F6819007F00F88E364FD4036A9C25BF357DD4 \ + && gpg --batch --verify /usr/local/bin/gosu.asc /usr/local/bin/gosu \ + && rm -r "$GNUPGHOME" /usr/local/bin/gosu.asc \ + && chmod +x /usr/local/bin/gosu \ + && gosu nobody true \ + && apt-get purge -y --auto-remove ca-certificates wget + RUN mkdir /docker-entrypoint-initdb.d # FATAL ERROR: please install the following Perl modules before executing /usr/local/mysql/scripts/mysql_install_db: @@ -19,10 +33,10 @@ ENV MYSQL_MAJOR 5.5 ENV MYSQL_VERSION 5.5.49 # note: we're pulling the *.asc file from mysql.he.net instead of dev.mysql.com because the official mirror 404s that file for whatever reason - maybe it's at a different path? -RUN apt-get update && apt-get install -y curl --no-install-recommends && rm -rf /var/lib/apt/lists/* \ - && curl -SL "http://dev.mysql.com/get/Downloads/MySQL-$MYSQL_MAJOR/mysql-$MYSQL_VERSION-linux2.6-x86_64.tar.gz" -o mysql.tar.gz \ - && curl -SL "http://mysql.he.net/Downloads/MySQL-$MYSQL_MAJOR/mysql-$MYSQL_VERSION-linux2.6-x86_64.tar.gz.asc" -o mysql.tar.gz.asc \ - && apt-get purge -y --auto-remove curl \ +RUN apt-get update && apt-get install -y wget --no-install-recommends && rm -rf /var/lib/apt/lists/* \ + && wget "http://dev.mysql.com/get/Downloads/MySQL-$MYSQL_MAJOR/mysql-$MYSQL_VERSION-linux2.6-x86_64.tar.gz" -O mysql.tar.gz \ + && wget "http://mysql.he.net/Downloads/MySQL-$MYSQL_MAJOR/mysql-$MYSQL_VERSION-linux2.6-x86_64.tar.gz.asc" -O mysql.tar.gz.asc \ + && apt-get purge -y --auto-remove wget \ && export GNUPGHOME="$(mktemp -d)" \ # gpg: key 5072E1F5: public key "MySQL Release Engineering " imported && gpg --keyserver ha.pool.sks-keyservers.net --recv-keys A4A9406876FCBD3C456770C88C718D3B5072E1F5 \ @@ -46,11 +60,15 @@ RUN mkdir -p /etc/mysql/conf.d \ echo '[mysqld]'; \ echo 'skip-host-cache'; \ echo 'skip-name-resolve'; \ - echo 'user = mysql'; \ echo 'datadir = /var/lib/mysql'; \ echo '!includedir /etc/mysql/conf.d/'; \ } > /etc/mysql/my.cnf +RUN mkdir -p /var/lib/mysql /var/run/mysqld \ + && chown -R mysql:mysql /var/lib/mysql /var/run/mysqld \ +# ensure that /var/run/mysqld (used for socket and lock files) is writable regardless of the UID our mysqld instance ends up having at runtime + && chmod 777 /var/run/mysqld + VOLUME /var/lib/mysql COPY docker-entrypoint.sh /usr/local/bin/ diff --git a/5.5/docker-entrypoint.sh b/5.5/docker-entrypoint.sh index 81144fc12..d62d76e00 100755 --- a/5.5/docker-entrypoint.sh +++ b/5.5/docker-entrypoint.sh @@ -17,9 +17,21 @@ for arg; do esac done +_datadir() { + "$@" --verbose --help --log-bin-index=`mktemp -u` 2>/dev/null | awk '$1 == "datadir" { print $2; exit }' +} + +# allow the container to be started with `--user` +if [ "$1" = 'mysqld' -a -z "$wantHelp" -a "$(id -u)" = '0' ]; then + DATADIR="$(_datadir "$@")" + mkdir -p "$DATADIR" + chown -R mysql:mysql "$DATADIR" + exec gosu mysql "$BASH_SOURCE" "$@" +fi + if [ "$1" = 'mysqld' -a -z "$wantHelp" ]; then # Get config - DATADIR="$("$@" --verbose --help --log-bin-index=`mktemp -u` 2>/dev/null | awk '$1 == "datadir" { print $2; exit }')" + DATADIR="$(_datadir "$@")" if [ ! -d "$DATADIR/mysql" ]; then if [ -z "$MYSQL_ROOT_PASSWORD" -a -z "$MYSQL_ALLOW_EMPTY_PASSWORD" -a -z "$MYSQL_RANDOM_ROOT_PASSWORD" ]; then @@ -29,10 +41,9 @@ if [ "$1" = 'mysqld' -a -z "$wantHelp" ]; then fi mkdir -p "$DATADIR" - chown -R mysql:mysql "$DATADIR" echo 'Initializing database' - mysql_install_db --user=mysql --datadir="$DATADIR" --rpm --basedir=/usr/local/mysql + mysql_install_db --datadir="$DATADIR" --rpm --basedir=/usr/local/mysql echo 'Database initialized' "$@" --skip-networking --basedir=/usr/local/mysql & @@ -117,8 +128,6 @@ if [ "$1" = 'mysqld' -a -z "$wantHelp" ]; then echo 'MySQL init process done. Ready for start up.' echo fi - - chown -R mysql:mysql "$DATADIR" fi exec "$@" diff --git a/5.6/Dockerfile b/5.6/Dockerfile index 19e6f381c..e156f3a08 100644 --- a/5.6/Dockerfile +++ b/5.6/Dockerfile @@ -3,6 +3,20 @@ FROM debian:jessie # add our user and group first to make sure their IDs get assigned consistently, regardless of whatever dependencies get added RUN groupadd -r mysql && useradd -r -g mysql mysql +# add gosu for easy step-down from root +ENV GOSU_VERSION 1.7 +RUN set -x \ + && apt-get update && apt-get install -y --no-install-recommends ca-certificates wget && rm -rf /var/lib/apt/lists/* \ + && wget -O /usr/local/bin/gosu "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$(dpkg --print-architecture)" \ + && wget -O /usr/local/bin/gosu.asc "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$(dpkg --print-architecture).asc" \ + && export GNUPGHOME="$(mktemp -d)" \ + && gpg --keyserver ha.pool.sks-keyservers.net --recv-keys B42F6819007F00F88E364FD4036A9C25BF357DD4 \ + && gpg --batch --verify /usr/local/bin/gosu.asc /usr/local/bin/gosu \ + && rm -r "$GNUPGHOME" /usr/local/bin/gosu.asc \ + && chmod +x /usr/local/bin/gosu \ + && gosu nobody true \ + && apt-get purge -y --auto-remove ca-certificates wget + RUN mkdir /docker-entrypoint-initdb.d # FATAL ERROR: please install the following Perl modules before executing /usr/local/mysql/scripts/mysql_install_db: @@ -29,7 +43,10 @@ RUN { \ echo mysql-community-server mysql-community-server/remove-test-db select false; \ } | debconf-set-selections \ && apt-get update && apt-get install -y mysql-server="${MYSQL_VERSION}" && rm -rf /var/lib/apt/lists/* \ - && rm -rf /var/lib/mysql && mkdir -p /var/lib/mysql + && rm -rf /var/lib/mysql && mkdir -p /var/lib/mysql /var/run/mysqld \ + && chown -R mysql:mysql /var/lib/mysql /var/run/mysqld \ +# ensure that /var/run/mysqld (used for socket and lock files) is writable regardless of the UID our mysqld instance ends up having at runtime + && chmod 777 /var/run/mysqld # comment out a few problematic configuration values # don't reverse lookup hostnames, they are usually another container diff --git a/5.6/docker-entrypoint.sh b/5.6/docker-entrypoint.sh index 4dace5b1b..a36575d0d 100755 --- a/5.6/docker-entrypoint.sh +++ b/5.6/docker-entrypoint.sh @@ -17,9 +17,21 @@ for arg; do esac done +_datadir() { + "$@" --verbose --help --log-bin-index=`mktemp -u` 2>/dev/null | awk '$1 == "datadir" { print $2; exit }' +} + +# allow the container to be started with `--user` +if [ "$1" = 'mysqld' -a -z "$wantHelp" -a "$(id -u)" = '0' ]; then + DATADIR="$(_datadir "$@")" + mkdir -p "$DATADIR" + chown -R mysql:mysql "$DATADIR" + exec gosu mysql "$BASH_SOURCE" "$@" +fi + if [ "$1" = 'mysqld' -a -z "$wantHelp" ]; then # Get config - DATADIR="$("$@" --verbose --help --log-bin-index=`mktemp -u` 2>/dev/null | awk '$1 == "datadir" { print $2; exit }')" + DATADIR="$(_datadir "$@")" if [ ! -d "$DATADIR/mysql" ]; then if [ -z "$MYSQL_ROOT_PASSWORD" -a -z "$MYSQL_ALLOW_EMPTY_PASSWORD" -a -z "$MYSQL_RANDOM_ROOT_PASSWORD" ]; then @@ -29,10 +41,9 @@ if [ "$1" = 'mysqld' -a -z "$wantHelp" ]; then fi mkdir -p "$DATADIR" - chown -R mysql:mysql "$DATADIR" echo 'Initializing database' - mysql_install_db --user=mysql --datadir="$DATADIR" --rpm --keep-my-cnf + mysql_install_db --datadir="$DATADIR" --rpm --keep-my-cnf echo 'Database initialized' "$@" --skip-networking & @@ -117,8 +128,6 @@ if [ "$1" = 'mysqld' -a -z "$wantHelp" ]; then echo 'MySQL init process done. Ready for start up.' echo fi - - chown -R mysql:mysql "$DATADIR" fi exec "$@" diff --git a/5.7/Dockerfile b/5.7/Dockerfile index 16f07ee06..ca77be6d8 100644 --- a/5.7/Dockerfile +++ b/5.7/Dockerfile @@ -3,6 +3,20 @@ FROM debian:jessie # add our user and group first to make sure their IDs get assigned consistently, regardless of whatever dependencies get added RUN groupadd -r mysql && useradd -r -g mysql mysql +# add gosu for easy step-down from root +ENV GOSU_VERSION 1.7 +RUN set -x \ + && apt-get update && apt-get install -y --no-install-recommends ca-certificates wget && rm -rf /var/lib/apt/lists/* \ + && wget -O /usr/local/bin/gosu "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$(dpkg --print-architecture)" \ + && wget -O /usr/local/bin/gosu.asc "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$(dpkg --print-architecture).asc" \ + && export GNUPGHOME="$(mktemp -d)" \ + && gpg --keyserver ha.pool.sks-keyservers.net --recv-keys B42F6819007F00F88E364FD4036A9C25BF357DD4 \ + && gpg --batch --verify /usr/local/bin/gosu.asc /usr/local/bin/gosu \ + && rm -r "$GNUPGHOME" /usr/local/bin/gosu.asc \ + && chmod +x /usr/local/bin/gosu \ + && gosu nobody true \ + && apt-get purge -y --auto-remove ca-certificates wget + RUN mkdir /docker-entrypoint-initdb.d # FATAL ERROR: please install the following Perl modules before executing /usr/local/mysql/scripts/mysql_install_db: @@ -29,7 +43,10 @@ RUN { \ echo mysql-community-server mysql-community-server/remove-test-db select false; \ } | debconf-set-selections \ && apt-get update && apt-get install -y mysql-server="${MYSQL_VERSION}" && rm -rf /var/lib/apt/lists/* \ - && rm -rf /var/lib/mysql && mkdir -p /var/lib/mysql + && rm -rf /var/lib/mysql && mkdir -p /var/lib/mysql /var/run/mysqld \ + && chown -R mysql:mysql /var/lib/mysql /var/run/mysqld \ +# ensure that /var/run/mysqld (used for socket and lock files) is writable regardless of the UID our mysqld instance ends up having at runtime + && chmod 777 /var/run/mysqld # comment out a few problematic configuration values # don't reverse lookup hostnames, they are usually another container diff --git a/5.7/docker-entrypoint.sh b/5.7/docker-entrypoint.sh index 2c6821ceb..fc6aed26a 100755 --- a/5.7/docker-entrypoint.sh +++ b/5.7/docker-entrypoint.sh @@ -17,9 +17,21 @@ for arg; do esac done +_datadir() { + "$@" --verbose --help 2>/dev/null | awk '$1 == "datadir" { print $2; exit }' +} + +# allow the container to be started with `--user` +if [ "$1" = 'mysqld' -a -z "$wantHelp" -a "$(id -u)" = '0' ]; then + DATADIR="$(_datadir "$@")" + mkdir -p "$DATADIR" + chown -R mysql:mysql "$DATADIR" + exec gosu mysql "$BASH_SOURCE" "$@" +fi + if [ "$1" = 'mysqld' -a -z "$wantHelp" ]; then # Get config - DATADIR="$("$@" --verbose --help 2>/dev/null | awk '$1 == "datadir" { print $2; exit }')" + DATADIR="$(_datadir "$@")" if [ ! -d "$DATADIR/mysql" ]; then if [ -z "$MYSQL_ROOT_PASSWORD" -a -z "$MYSQL_ALLOW_EMPTY_PASSWORD" -a -z "$MYSQL_RANDOM_ROOT_PASSWORD" ]; then @@ -29,7 +41,6 @@ if [ "$1" = 'mysqld' -a -z "$wantHelp" ]; then fi mkdir -p "$DATADIR" - chown -R mysql:mysql "$DATADIR" echo 'Initializing database' "$@" --initialize-insecure @@ -117,8 +128,6 @@ if [ "$1" = 'mysqld' -a -z "$wantHelp" ]; then echo 'MySQL init process done. Ready for start up.' echo fi - - chown -R mysql:mysql "$DATADIR" fi exec "$@"