epicmorg/mysql repository overview

⁠epicmorg/mysql

MySQL from Oracle's generic Linux tarballs (GPG signature checked with the MySQL Release Engineering keys) on Debian 13 trixie, one tag per release line at its newest patch: the legacy 5.6 / 5.7, 8.0, the LTS lines 8.4 and 9.7, the current Innovation release, and the ended Innovation releases 8.1 - 8.3, 9.0 - 9.6 at their final patch (their tags are in use). The entrypoint is a drop-in for library/mysql (MYSQL_ROOT_PASSWORD & co., /var/lib/mysql, /etc/mysql/conf.d, /docker-entrypoint-initdb.d, uid 999) and understands the bitnami/mysql variables too (MYSQL_ROOT_USER, ALLOW_EMPTY_PASSWORD, character set, replication, /bitnami/mysql, my_custom.cnf). MySQL itself is not built from source (CMake + Boost, hours per line); what is ours: the base, the libraries trixie lacks, the entrypoint and the fatal checks.

⁠What's inside

• MySQL in /usr/local/share/epicmorg/mysql/<line> (also /usr/local/mysql), on PATH; the vendor's lib/private (OpenSSL, Kerberos, LDAP, SASL, protobuf of 8.0+) is used as shipped - one OpenSSL per process;
• baked here: libaio 0.3.113 (trixie only has libaio.so.1t64) for every line and ncurses 6.6 built with ABI 5 (libncurses.so.5 / libtinfo.so.5) for the 5.x clients, wired into the vendor ELF files with patchelf --force-rpath (appended after their own $ORIGIN/../lib/private) - nothing in ld.so.conf;
• the test suite, debug / embedded binaries and static libraries are removed from the tarballs;
• /emg-export - MySQL + those libraries for COPY --from;
• entrypoint under tini; mysqld runs as mysql (uid 999) when the container starts as root; volume /var/lib/mysql, ports 3306 / 33060; HEALTHCHECK = mysqladmin ping.

Fatal build-time checks: server and client versions, no unresolved libraries anywhere in bin/ / lib/, at most one libssl per ELF and it is MySQL's own, mysqld uses the baked libaio, and a smoke test - first start with root / database / user, time zone tables, a TLS session (5.7+), runs as mysql, restart on the persisted datadir, the bitnami variables (MYSQL_ROOT_USER, character set and collation), refusal to initialise without a password option.

⁠Variables

Read on the first start (empty datadir) unless noted.

/docker-entrypoint-initdb.d/*.sh (sourced, or run when executable) and *.sql, *.sql.gz, *.sql.bz2, *.sql.xz, *.sql.zst run once, against MYSQL_DATABASE when set. Arguments starting with - go to mysqld; any other command (mysql, mysqldump, bash) runs as is. A mounted /bitnami/mysql becomes --datadir=/bitnami/mysql/data; /opt/bitnami/mysql/conf/my_custom.cnf is included via /etc/mysql/conf.d.

⁠Tags

Every tag is pushed to docker.io, quay.io and ghcr.io (epicmorg/mysql:<tag> on each) - same digest everywhere.

⁠Usage

services:
  mysql:
    image: epicmorg/mysql:8.4          # was: mysql:8.4 - environment and volume unchanged
    restart: always
    environment:
      MYSQL_ROOT_PASSWORD_FILE: /run/secrets/mysql-root
      MYSQL_DATABASE: app
      MYSQL_USER: app
      MYSQL_PASSWORD_FILE: /run/secrets/mysql-app
    volumes:
      - ./mysql:/var/lib/mysql
      - ./initdb:/docker-entrypoint-initdb.d:ro
    secrets: [mysql-root, mysql-app]
secrets:
  mysql-root:
    file: ./mysql-root.txt
  mysql-app:
    file: ./mysql-app.txt

⁠Notes

• 5.6, 5.7 and 8.0 are end-of-life upstream; they are here for data that has to be read or migrated. Upgrade a datadir one line at a time (5.6 -> 5.7 -> 8.0 -> 8.4 -> 9.7).
• An Innovation release is supported until the next one; latest / innovation move on, the ended line keeps its tag at its final patch (not rebuilt from newer sources - there are none).
• Licences: MySQL Community Server is GPLv2 (with the FOSS exception); the image recipe is MIT.

Folders are written by bin/python/mysql-versions-sync.py.

⁠Links

• Source: EpicMorg/docker⁠ - issues and PRs welcome
• Tags float and are rebuilt weekly; pin by digest for reproducible builds: Tags, pinning and updates⁠
• CHANGELOG⁠ - License: MIT