epicmorg/mariadb repository overview

⁠epicmorg/mariadb

MariaDB from the project's bintar tarballs (archive.mariadb.org, GPG signature checked with the MariaDB signing keys) on Debian 13 trixie, one tag per release line at its newest patch: the supported LTS lines 10.11, 11.4, 11.8, 12.3, the rolling stable 13.0, and the ended series 5.5, 10.0 - 10.6 for data that has to be read or migrated. The entrypoint is a drop-in for library/mariadb (MARIADB_* with the MYSQL_* aliases, /var/lib/mysql, /etc/mysql/conf.d, /docker-entrypoint-initdb.d, uid 999) and understands the bitnami/mariadb variables too (MARIADB_ROOT_USER, ALLOW_EMPTY_PASSWORD, character set, replication, /bitnami/mariadb, my_custom.cnf). MariaDB itself is not built from source; what is ours: the base, the libraries trixie lacks, the entrypoint and the fatal checks.

⁠What's inside

• MariaDB in /usr/local/share/epicmorg/mariadb/<line> (also /usr/local/mariadb, /usr/local/mysql), on PATH; glibc_214 builds up to 10.4, systemd builds from 10.5; TLS is linked into the server statically;
• baked here: libaio 0.3.113 (trixie only has libaio.so.1t64) and ncurses 6.6 built with ABI 5 (libncurses.so.5 / libtinfo.so.5) for the clients up to 10.5, wired into the vendor ELF files with patchelf --force-rpath - nothing in ld.so.conf; Debian's libcrack2 / libodbc2 / Judy for the cracklib / CONNECT / OQGraph plugins;
• Galera is not included (its provider and garbd link OpenSSL 1.1 / Boost 1.66 - a second OpenSSL next to the server's own); the test suite, debug / embedded binaries and static libraries are removed too;
• /emg-export - MariaDB + those libraries for COPY --from;
• entrypoint under tini; the server runs as mysql (uid 999) when the container starts as root; volume /var/lib/mysql, port 3306; HEALTHCHECK = mariadb-admin ping.

Fatal build-time checks: server and client versions, no unresolved libraries anywhere in bin/ / lib/, at most one libssl per ELF, the server uses the baked libaio, and a smoke test - first start with root / database / user, time zone tables, no anonymous accounts, a TLS session (11.4+, zero-configuration TLS), runs as mysql, restart on the persisted datadir, the bitnami variables (MARIADB_ROOT_USER, character set and collation), refusal to initialise without a password option.

⁠Variables

Every MARIADB_* name below also works as MYSQL_* (MARIADB_* wins). Read on the first start (empty datadir) unless noted.

/docker-entrypoint-initdb.d/*.sh (sourced, or run when executable) and *.sql, *.sql.gz, *.sql.bz2, *.sql.xz, *.sql.zst run once, against MARIADB_DATABASE when set. Arguments starting with - go to the server; any other command (mariadb, mariadb-dump, bash) runs as is. A mounted /bitnami/mariadb becomes --datadir=/bitnami/mariadb/data; /opt/bitnami/mariadb/conf/my_custom.cnf is included via /etc/mysql/conf.d.

⁠Tags

Every tag is pushed to docker.io, quay.io and ghcr.io (epicmorg/mariadb:<tag> on each) - same digest everywhere.

⁠Usage

services:
  mariadb:
    image: epicmorg/mariadb:11.8          # was: mariadb:11.8 - environment and volume unchanged
    restart: always
    environment:
      MARIADB_ROOT_PASSWORD_FILE: /run/secrets/mariadb-root
      MARIADB_DATABASE: app
      MARIADB_USER: app
      MARIADB_PASSWORD_FILE: /run/secrets/mariadb-app
    volumes:
      - ./mariadb:/var/lib/mysql
    secrets: [mariadb-root, mariadb-app]
secrets:
  mariadb-root:
    file: ./mariadb-root.txt
  mariadb-app:
    file: ./mariadb-app.txt

⁠Notes

• Upgrade a datadir one major series at a time (5.5 -> 10.0 -> ... -> 10.6 -> 10.11 -> 11.4 ...); the image upgrades the system tables itself (see MARIADB_AUTO_UPGRADE).
• Licences: MariaDB Server is GPLv2; the image recipe is MIT.

Folders are written by bin/python/mariadb-versions-sync.py.

⁠Links

• Source: EpicMorg/docker⁠ - issues and PRs welcome
• Tags float and are rebuilt weekly; pin by digest for reproducible builds: Tags, pinning and updates⁠
• CHANGELOG⁠ - License: MIT