Sign inSign up

nullata/mariadb-galera

By nullata

•Updated 4 days ago

Debian based MariaDB w/ Galera multi-primary synchronous replication and high availability cluster.

Image
Integration & delivery
Developer tools
Databases & storage
1

10K+

nullata/mariadb-galera repository overview

Logo

⁠Nullata Image for MariaDB Galera

⁠What is MariaDB Galera?

MariaDB Galera is a multi-primary database cluster solution for synchronous replication and high availability. Nullata MariaDB Galera images have functional support for LDAP, SSL/TLS, and multiple modes of operation, aimed at maximum flexibility for various types of deployment environments.

Overview of MariaDB Galera⁠ Trademarks: This software listing is packaged by Nullata. The respective trademarks mentioned in the offering are owned by the respective companies, and use of them does not imply any affiliation or endorsement.

⁠TL;DR

docker run --name mariadb \
  -e ALLOW_EMPTY_PASSWORD=yes \
  nullata/mariadb-galera:latest

⚠️ Warning ⚠️: Quick setups are only intended for development environments. You are encouraged to change the insecure default credentials and check out the available configuration options in the Configuration⁠ section for a more secure deployment.

✨ For production deployments, refer to the example Docker Compose setups available in the GitHub repository⁠ for each respective version. These include multi-node configurations and recommended environment settings for different versions.

⁠Get this image

The recommended way to get the Nullata MariaDB Galera Docker Image is to pull the prebuilt image from the Docker Hub Registry⁠.

docker pull nullata/mariadb-galera:latest

To use a specific version, you can pull a versioned tag. You can view the list of available versions⁠ in the Docker Hub Registry.

docker pull nullata/mariadb-galera:[TAG]

⁠Persisting your database

If you remove the container all your data will be lost, and the next time you run the image the database will be reinitialized. To avoid this loss of data, you should mount a volume that will persist even after the container is removed.

For persistence you should mount a directory at the /nullata/mariadb path. If the mounted directory is empty, it will be initialized on the first run.

docker run \
    -e ALLOW_EMPTY_PASSWORD=yes \
    -v /path/to/mariadb-persistence:/nullata/mariadb \
    nullata/mariadb-galera:latest

or by modifying the docker-compose.yml file present in each respective version directory in this repository:

services:
  mariadb:
  ...
    volumes:
      - /path/to/mariadb-persistence:/nullata/mariadb
  ...

⁠Connecting to other containers

Using Docker container networking⁠, a MariaDB server running inside a container can easily be accessed by your application containers.

Containers attached to the same network can communicate with each other using the container name as the hostname.

⁠Using the Command Line

In this example, we will create a MariaDB client instance that will connect to the server instance that is running on the same docker network as the client.

⁠Step 1: Create a network
docker network create app --driver bridge
⁠Step 2: Launch the MariaDB server instance

Use the --network app argument to the docker run command to attach the MariaDB container to the app network.

docker run -d --name mariadb-galera \
    -e ALLOW_EMPTY_PASSWORD=yes \
    --network app \
    nullata/mariadb-galera:latest
⁠Step 3: Launch your MariaDB client instance

Finally we create a new container instance to launch the MariaDB client and connect to the server created in the previous step:

docker run -it --rm \
    --network app \
    nullata/mariadb-galera:latest mysql -h mariadb-galera -u root
⁠Using a Docker Compose file

When not specified, Docker Compose automatically sets up a new network and attaches all deployed services to that network. However, we will explicitly define a new bridge network named database. In this example we assume that you want to connect to the MariaDB server from your own custom application image which is identified in the following snippet by the service name myapp.

version: '2'

networks:
  app:
    driver: bridge
  database:
    driver: bridge

services:
  mariadb-galera:
    image: nullata/mariadb-galera:latest
    environment:
      - ALLOW_EMPTY_PASSWORD=yes
    networks:
      - database

  myapp:
    image: YOUR_APPLICATION_IMAGE
    networks:
      - app
      - database

Launch the containers using:

docker compose up -d
⁠Additional docker-compose examples (single node; full mesh cluster; primary-join topology)
services:
    ############################################
    # Single node test
    ############################################
    mariadb-single:
        profiles: ["test-single"]
        image: nullata/mariadb-galera:latest
        ports:
            - "10912:3306" # example testing external port
        volumes:
            - "/opt/services/database/nullata-galera-test:/nullata/mariadb"
        environment:
            - MARIADB_GALERA_CLUSTER_ADDRESS=gcomm://
            - MARIADB_GALERA_CLUSTER_BOOTSTRAP=yes
            - MARIADB_GALERA_CLUSTER_NAME=test-single
            - MARIADB_GALERA_MARIABACKUP_USER=backup
            - MARIADB_GALERA_MARIABACKUP_PASSWORD=testpass
            - MARIADB_USER=testuser
            - MARIADB_PASSWORD=testpass
            - MARIADB_ROOT_PASSWORD=testroot
            - MARIADB_DATABASE=testdb
        healthcheck:
            test: ["CMD", "/opt/nullata/scripts/mariadb-galera/healthcheck.sh"]
            interval: 15s
            timeout: 5s
            retries: 6

    ############################################
    # Explicit full mesh
    ############################################
    mariadb-node1:
        profiles: ["test-cluster"]
        image: nullata/mariadb-galera:latest
        ports:
            - "10913:3306" # example testing external port
        volumes:
            - "/opt/services/database/nullata-galera-test-node1:/nullata/mariadb"
            - "/opt/services/database/backup/nullata-galera-test:/backup"
        environment:
            - MARIADB_GALERA_CLUSTER_ADDRESS=gcomm://mariadb-node1,mariadb-node2,mariadb-node3
            - MARIADB_GALERA_CLUSTER_BOOTSTRAP=yes
            - MARIADB_GALERA_CLUSTER_NAME=test-cluster
            - MARIADB_GALERA_MARIABACKUP_USER=backup
            - MARIADB_GALERA_MARIABACKUP_PASSWORD=testpass
            - MARIADB_ROOT_PASSWORD=testroot
            # force a re-bootstrap after a total outage:
            - MARIADB_GALERA_FORCE_SAFETOBOOTSTRAP=yes
        healthcheck:
            test: ["CMD", "/opt/nullata/scripts/mariadb-galera/healthcheck.sh"]

    mariadb-node2:
        profiles: ["test-cluster"]
        image: nullata/mariadb-galera:latest
        ports:
            - "10914:3306" # example testing external port
        volumes:
            - "/opt/services/database/nullata-galera-test-node2:/nullata/mariadb"
        environment:
            - MARIADB_GALERA_CLUSTER_ADDRESS=gcomm://mariadb-node1,mariadb-node2,mariadb-node3
            - MARIADB_GALERA_CLUSTER_NAME=test-cluster
            - MARIADB_GALERA_MARIABACKUP_USER=backup
            - MARIADB_GALERA_MARIABACKUP_PASSWORD=testpass
            - MARIADB_ROOT_PASSWORD=testroot
        depends_on:
            mariadb-node1:
                condition: service_healthy
        healthcheck:
            test: ["CMD", "/opt/nullata/scripts/mariadb-galera/healthcheck.sh"]

    mariadb-node3:
        profiles: ["test-cluster"]
        image: nullata/mariadb-galera:latest
        ports:
            - "10915:3306" # example testing external port
        volumes:
            - "/opt/services/database/nullata-galera-test-node3:/nullata/mariadb"
        environment:
            - MARIADB_GALERA_CLUSTER_ADDRESS=gcomm://mariadb-node1,mariadb-node2,mariadb-node3
            - MARIADB_GALERA_CLUSTER_NAME=test-cluster
            - MARIADB_GALERA_MARIABACKUP_USER=backup
            - MARIADB_GALERA_MARIABACKUP_PASSWORD=testpass
            - MARIADB_ROOT_PASSWORD=testroot
        depends_on:
            mariadb-node1:
                condition: service_healthy
        healthcheck:
            test: ["CMD", "/opt/nullata/scripts/mariadb-galera/healthcheck.sh"]

    ############################################
    # Primary-join (star topology)
    ############################################
    mariadb-seed:
        profiles: ["test-seed"]
        image: nullata/mariadb-galera:latest
        ports:
          - "10916:3306" # example testing external port
        volumes:
            - "/opt/services/database/nullata-galera-test-seed0:/nullata/mariadb"
            - "/opt/services/database/backup/nullata-galera-test:/backup"
        environment:
            - MARIADB_GALERA_CLUSTER_ADDRESS=gcomm://
            - MARIADB_GALERA_CLUSTER_BOOTSTRAP=yes
            - MARIADB_GALERA_CLUSTER_NAME=test-seed
            - MARIADB_GALERA_MARIABACKUP_USER=backup
            - MARIADB_GALERA_MARIABACKUP_PASSWORD=testpass
            - MARIADB_ROOT_PASSWORD=testroot
            # force a re-bootstrap after a total outage:
            - MARIADB_GALERA_FORCE_SAFETOBOOTSTRAP=yes
        healthcheck:
            test: ["CMD", "/opt/nullata/scripts/mariadb-galera/healthcheck.sh"]

    mariadb-join1:
        profiles: ["test-seed"]
        image: nullata/mariadb-galera:latest
        ports:
            - "10917:3306" # example testing external port
        volumes:
            - "/opt/services/database/nullata-galera-test-join1:/nullata/mariadb"
        environment:
            - MARIADB_GALERA_CLUSTER_ADDRESS=gcomm://mariadb-seed
            - MARIADB_GALERA_CLUSTER_NAME=test-seed
            - MARIADB_GALERA_MARIABACKUP_USER=backup
            - MARIADB_GALERA_MARIABACKUP_PASSWORD=testpass
            - MARIADB_ROOT_PASSWORD=testroot
        depends_on:
            mariadb-seed:
                condition: service_healthy
        healthcheck:
            test: ["CMD", "/opt/nullata/scripts/mariadb-galera/healthcheck.sh"]

Run a profile with:

docker compose --profile <profile> up -d

⁠Configuration

For additional configuration details, environment variables, docker-compose & build-it-yourself instructions, please visit: github.com/nullata/containers⁠

⁠Hardened Image

⁠⚠️ LATEST tag NOT based on HARDENED⚠️

HARDENED images add some additional security considerations and an overall smaller image size aiming to reduce overall attack vectors. Here is a list of the added improvements:

  • Based on debian:bookworm-slim
  • Removed docs, man pages post-install
  • Dedicated user account
  • Non-login shell
  • Stripped static libraries
  • Removed test directories
  • Package managers removed
  • Restrictive directory permissions
  • Root-owned binaries
  • Restrictive umask
  • Removed group write permissions
  • Strip all setuid/setgid bits
  • Remove world-writable directories
  • Normalize executable permissions
  • Sticky bit on temp directories
  • Cleared cache directories
  • Build metadata labels
  • Enhanced OCI labels
  • Shell with pipefail
  • Built-in health check
  • Start period grace time
  • No privilege escalation
  • Minimal capabilities (cap_drop: ALL, CHOWN, DAC_OVERRIDE, SETGID, SETUID, NET_BIND_SERVICE)
  • Secure tmpfs mounts
  • Prevents executable injection via tmpfs restrictions
  • CPU limits & Memory limits

Additional hardened images usage examples

 services:
    ############################################
    # Single node test
    ############################################
    mariadb-single:
        profiles: ["test-single"]
        image: nullata/mariadb-galera:12.3.2-hardened

        security_opt:
            - no-new-privileges:true

        cap_drop:
            - ALL
        cap_add:
            - CHOWN
            - DAC_OVERRIDE
            - SETGID
            - SETUID
            - NET_BIND_SERVICE

        ports:
            - "10912:3306" # example testing external port

        volumes:
            - "/opt/services/database/nullata-galera-test:/nullata/mariadb"

        # temporary filesystems with security restrictions
        tmpfs:
            - /tmp:nosuid,nodev,size=1g,mode=1777
            - /var/tmp:nosuid,nodev,size=500m,mode=1777

        environment:
            - MARIADB_GALERA_CLUSTER_ADDRESS=gcomm://
            - MARIADB_GALERA_CLUSTER_BOOTSTRAP=yes
            - MARIADB_GALERA_CLUSTER_NAME=test-single
            - MARIADB_GALERA_MARIABACKUP_USER=backup
            - MARIADB_GALERA_MARIABACKUP_PASSWORD=testpass
            - MARIADB_USER=testuser
            - MARIADB_PASSWORD=testpass
            - MARIADB_ROOT_PASSWORD=testroot
            - MARIADB_DATABASE=testdb

        healthcheck:
            test: ["CMD", "/opt/nullata/scripts/mariadb-galera/healthcheck.sh"]
            interval: 15s
            timeout: 5s
            retries: 6
            start_period: 60s

        # resource limits
        deploy:
            resources:
                limits:
                    cpus: '2'
                    memory: 4G
                reservations:
                    cpus: '1'
                    memory: 2G

    ############################################
    # Explicit full mesh
    ############################################
    mariadb-node1:
        profiles: ["test-cluster"]
        image: nullata/mariadb-galera:12.3.2-hardened

        security_opt:
            - no-new-privileges:true

        cap_drop:
            - ALL
        cap_add:
            - CHOWN
            - DAC_OVERRIDE
            - SETGID
            - SETUID
            - NET_BIND_SERVICE

        ports:
            - "10913:3306" # example testing external port

        volumes:
            - "/opt/services/database/nullata-galera-test-node1:/nullata/mariadb"
            - "/opt/services/database/backup/nullata-galera-test:/backup"

        tmpfs:
            - /tmp:nosuid,nodev,size=1g,mode=1777
            - /var/tmp:nosuid,nodev,size=500m,mode=1777

        environment:
            - MARIADB_GALERA_CLUSTER_ADDRESS=gcomm://mariadb-node1,mariadb-node2,mariadb-node3
            - MARIADB_GALERA_CLUSTER_BOOTSTRAP=yes
            - MARIADB_GALERA_CLUSTER_NAME=test-cluster
            - MARIADB_GALERA_MARIABACKUP_USER=backup
            - MARIADB_GALERA_MARIABACKUP_PASSWORD=testpass
            - MARIADB_ROOT_PASSWORD=testroot
            - MARIADB_GALERA_FORCE_SAFETOBOOTSTRAP=yes

        healthcheck:
            test: ["CMD", "/opt/nullata/scripts/mariadb-galera/healthcheck.sh"]
            interval: 15s
            timeout: 5s
            retries: 6
            start_period: 60s

        deploy:
            resources:
                limits:
                    cpus: '2'
                    memory: 4G
                reservations:
                    cpus: '1'
                    memory: 2G

    mariadb-node2:
        profiles: ["test-cluster"]
        image: nullata/mariadb-galera:12.3.2-hardened

        security_opt:
            - no-new-privileges:true

        cap_drop:
            - ALL
        cap_add:
            - CHOWN
            - DAC_OVERRIDE
            - SETGID
            - SETUID
            - NET_BIND_SERVICE

        ports:
            - "10914:3306" # example testing external port

        volumes:
            - "/opt/services/database/nullata-galera-test-node2:/nullata/mariadb"

        tmpfs:
            - /tmp:nosuid,nodev,size=1g,mode=1777
            - /var/tmp:nosuid,nodev,size=500m,mode=1777

        environment:
            - MARIADB_GALERA_CLUSTER_ADDRESS=gcomm://mariadb-node1,mariadb-node2,mariadb-node3
            - MARIADB_GALERA_CLUSTER_NAME=test-cluster
            - MARIADB_GALERA_MARIABACKUP_USER=backup
            - MARIADB_GALERA_MARIABACKUP_PASSWORD=testpass
            - MARIADB_ROOT_PASSWORD=testroot

        depends_on:
            mariadb-node1:
                condition: service_healthy

        healthcheck:
            test: ["CMD", "/opt/nullata/scripts/mariadb-galera/healthcheck.sh"]
            interval: 15s
            timeout: 5s
            retries: 6
            start_period: 60s

        deploy:
            resources:
                limits:
                    cpus: '2'
                    memory: 4G
                reservations:
                    cpus: '1'
                    memory: 2G

    mariadb-node3:
        profiles: ["test-cluster"]
        image: nullata/mariadb-galera:12.3.2-hardened

        security_opt:
            - no-new-privileges:true

        cap_drop:
            - ALL
        cap_add:
            - CHOWN
            - DAC_OVERRIDE
            - SETGID
            - SETUID
            - NET_BIND_SERVICE

        ports:
            - "10915:3306" # example testing external port

        volumes:
            - "/opt/services/database/nullata-galera-test-node3:/nullata/mariadb"

        tmpfs:
            - /tmp:nosuid,nodev,size=1g,mode=1777
            - /var/tmp:nosuid,nodev,size=500m,mode=1777

        environment:
            - MARIADB_GALERA_CLUSTER_ADDRESS=gcomm://mariadb-node1,mariadb-node2,mariadb-node3
            - MARIADB_GALERA_CLUSTER_NAME=test-cluster
            - MARIADB_GALERA_MARIABACKUP_USER=backup
            - MARIADB_GALERA_MARIABACKUP_PASSWORD=testpass
            - MARIADB_ROOT_PASSWORD=testroot

        depends_on:
            mariadb-node1:
                condition: service_healthy

        healthcheck:
            test: ["CMD", "/opt/nullata/scripts/mariadb-galera/healthcheck.sh"]
            interval: 15s
            timeout: 5s
            retries: 6
            start_period: 60s

        deploy:
            resources:
                limits:
                    cpus: '2'
                    memory: 4G
                reservations:
                    cpus: '1'
                    memory: 2G

    ############################################
    # Primary-join (star topology)
    ############################################
    mariadb-seed:
        profiles: ["test-seed"]
        image: nullata/mariadb-galera:12.3.2-hardened

        security_opt:
            - no-new-privileges:true

        cap_drop:
            - ALL
        cap_add:
            - CHOWN
            - DAC_OVERRIDE
            - SETGID
            - SETUID
            - NET_BIND_SERVICE

        ports:
            - "10916:3306" # example testing external port

        volumes:
            - "/opt/services/database/nullata-galera-test-seed0:/nullata/mariadb"
            - "/opt/services/database/backup/nullata-galera-test:/backup"

        tmpfs:
            - /tmp:nosuid,nodev,size=1g,mode=1777
            - /var/tmp:nosuid,nodev,size=500m,mode=1777

        environment:
            - MARIADB_GALERA_CLUSTER_ADDRESS=gcomm://
            - MARIADB_GALERA_CLUSTER_BOOTSTRAP=yes
            - MARIADB_GALERA_CLUSTER_NAME=test-seed
            - MARIADB_GALERA_MARIABACKUP_USER=backup
            - MARIADB_GALERA_MARIABACKUP_PASSWORD=testpass
            - MARIADB_ROOT_PASSWORD=testroot
            - MARIADB_GALERA_FORCE_SAFETOBOOTSTRAP=yes

        healthcheck:
            test: ["CMD", "/opt/nullata/scripts/mariadb-galera/healthcheck.sh"]
            interval: 15s
            timeout: 5s
            retries: 6
            start_period: 60s

        deploy:
            resources:
                limits:
                    cpus: '2'
                    memory: 4G
                reservations:
                    cpus: '1'
                    memory: 2G


    mariadb-join1:
        profiles: ["test-seed"]
        image: nullata/mariadb-galera:12.3.2-hardened

        security_opt:
            - no-new-privileges:true

        cap_drop:
            - ALL
        cap_add:
            - CHOWN
            - DAC_OVERRIDE
            - SETGID
            - SETUID
            - NET_BIND_SERVICE

        ports:
            - "10917:3306" # example testing external port

        volumes:
            - "/opt/services/database/nullata-galera-test-join1:/nullata/mariadb"

        tmpfs:
            - /tmp:nosuid,nodev,size=1g,mode=1777
            - /var/tmp:nosuid,nodev,size=500m,mode=1777

        environment:
            - MARIADB_GALERA_CLUSTER_ADDRESS=gcomm://mariadb-seed
            - MARIADB_GALERA_CLUSTER_NAME=test-seed
            - MARIADB_GALERA_MARIABACKUP_USER=backup
            - MARIADB_GALERA_MARIABACKUP_PASSWORD=testpass
            - MARIADB_ROOT_PASSWORD=testroot

        depends_on:
            mariadb-seed:
                condition: service_healthy

        healthcheck:
            test: ["CMD", "/opt/nullata/scripts/mariadb-galera/healthcheck.sh"]
            interval: 15s
            timeout: 5s
            retries: 6
            start_period: 60s

        deploy:
            resources:
                limits:
                    cpus: '2'
                    memory: 4G
                reservations:
                    cpus: '1'
                    memory: 2G

✨Report issues to: github.com/nullata/containers/issues⁠

✨ Submit additional image requests at: github.com/nullata/containers⁠

✨ Support the project: ko-fi.com/nickscripts⁠

Tag summary

Content type

Image

Digest

sha256:4d131a4c0…

Size

271.5 MB

Last updated

4 days ago

docker pull nullata/mariadb-galera