From 52abf70205354001f24432c0c677be4a0264ef47 Mon Sep 17 00:00:00 2001 From: Joe Ferguson Date: Mon, 23 Oct 2017 16:07:18 -0700 Subject: [PATCH] Resync changes from mysql/mariadb: improve bind-address comment out, add `MYSQL_ROOT_HOST` support See also https://github.com/docker-library/mysql/pull/336 and https://github.com/docker-library/mysql/pull/249 --- 5.5/Dockerfile | 10 ++++------ 5.5/docker-entrypoint.sh | 20 +++++++++++++++++--- 5.6/Dockerfile | 10 ++++------ 5.6/docker-entrypoint.sh | 20 +++++++++++++++++--- 5.7/Dockerfile | 10 ++++------ 5.7/docker-entrypoint.sh | 20 +++++++++++++++++--- Dockerfile.template | 10 ++++------ 7 files changed, 67 insertions(+), 33 deletions(-) diff --git a/5.5/Dockerfile b/5.5/Dockerfile index e2025da..e5206cc 100644 --- a/5.5/Dockerfile +++ b/5.5/Dockerfile @@ -74,14 +74,12 @@ RUN { \ && rm -rf /var/lib/mysql && mkdir -p /var/lib/mysql /var/run/mysqld \ && chown -R mysql:mysql /var/lib/mysql /var/run/mysqld \ # ensure that /var/run/mysqld (used for socket and lock files) is writable regardless of the UID our mysqld instance ends up having at runtime - && chmod 777 /var/run/mysqld - + && chmod 777 /var/run/mysqld \ # comment out a few problematic configuration values -# don't reverse lookup hostnames, they are usually another container -RUN \ - find /etc/mysql/ -name '*.cnf' -print0 \ + && find /etc/mysql/ -name '*.cnf' -print0 \ | xargs -0 grep -lZE '^(bind-address|log)' \ - | xargs -0 sed -Ei 's/^(bind-address|log)/#&/' \ + | xargs -rt -0 sed -Ei 's/^(bind-address|log)/#&/' \ +# don't reverse lookup hostnames, they are usually another container && echo '[mysqld]\nskip-host-cache\nskip-name-resolve' > /etc/mysql/conf.d/docker.cnf VOLUME ["/var/lib/mysql", "/var/log/mysql"] diff --git a/5.5/docker-entrypoint.sh b/5.5/docker-entrypoint.sh index 2e6799d..42a4cc7 100755 --- a/5.5/docker-entrypoint.sh +++ b/5.5/docker-entrypoint.sh @@ -113,14 +113,28 @@ if [ "$1" = 'mysqld' -a -z "$wantHelp" ]; then export MYSQL_ROOT_PASSWORD="$(pwgen -1 32)" echo "GENERATED ROOT PASSWORD: $MYSQL_ROOT_PASSWORD" fi + + rootCreate= + # default root to listen for connections from anywhere + file_env 'MYSQL_ROOT_HOST' '%' + if [ ! -z "$MYSQL_ROOT_HOST" -a "$MYSQL_ROOT_HOST" != 'localhost' ]; then + # no, we don't care if read finds a terminating character in this heredoc + # https://unix.stackexchange.com/questions/265149/why-is-set-o-errexit-breaking-this-read-heredoc-expression/265151#265151 + read -r -d '' rootCreate <<-EOSQL || true + CREATE USER 'root'@'${MYSQL_ROOT_HOST}' IDENTIFIED BY '${MYSQL_ROOT_PASSWORD}' ; + GRANT ALL ON *.* TO 'root'@'${MYSQL_ROOT_HOST}' WITH GRANT OPTION ; + EOSQL + fi + "${mysql[@]}" <<-EOSQL -- What's done in this file shouldn't be replicated -- or products like mysql-fabric won't work SET @@SESSION.SQL_LOG_BIN=0; - DELETE FROM mysql.user ; - CREATE USER 'root'@'%' IDENTIFIED BY '${MYSQL_ROOT_PASSWORD}' ; - GRANT ALL ON *.* TO 'root'@'%' WITH GRANT OPTION ; + DELETE FROM mysql.user WHERE user NOT IN ('mysql.sys', 'mysqlxsys', 'root') OR host NOT IN ('localhost') ; + SET PASSWORD FOR 'root'@'localhost'=PASSWORD('${MYSQL_ROOT_PASSWORD}') ; + GRANT ALL ON *.* TO 'root'@'localhost' WITH GRANT OPTION ; + ${rootCreate} DROP DATABASE IF EXISTS test ; FLUSH PRIVILEGES ; EOSQL diff --git a/5.6/Dockerfile b/5.6/Dockerfile index a379500..edb6289 100644 --- a/5.6/Dockerfile +++ b/5.6/Dockerfile @@ -74,14 +74,12 @@ RUN { \ && rm -rf /var/lib/mysql && mkdir -p /var/lib/mysql /var/run/mysqld \ && chown -R mysql:mysql /var/lib/mysql /var/run/mysqld \ # ensure that /var/run/mysqld (used for socket and lock files) is writable regardless of the UID our mysqld instance ends up having at runtime - && chmod 777 /var/run/mysqld - + && chmod 777 /var/run/mysqld \ # comment out a few problematic configuration values -# don't reverse lookup hostnames, they are usually another container -RUN \ - find /etc/mysql/ -name '*.cnf' -print0 \ + && find /etc/mysql/ -name '*.cnf' -print0 \ | xargs -0 grep -lZE '^(bind-address|log)' \ - | xargs -0 sed -Ei 's/^(bind-address|log)/#&/' \ + | xargs -rt -0 sed -Ei 's/^(bind-address|log)/#&/' \ +# don't reverse lookup hostnames, they are usually another container && echo '[mysqld]\nskip-host-cache\nskip-name-resolve' > /etc/mysql/conf.d/docker.cnf VOLUME ["/var/lib/mysql", "/var/log/mysql"] diff --git a/5.6/docker-entrypoint.sh b/5.6/docker-entrypoint.sh index 2e6799d..42a4cc7 100755 --- a/5.6/docker-entrypoint.sh +++ b/5.6/docker-entrypoint.sh @@ -113,14 +113,28 @@ if [ "$1" = 'mysqld' -a -z "$wantHelp" ]; then export MYSQL_ROOT_PASSWORD="$(pwgen -1 32)" echo "GENERATED ROOT PASSWORD: $MYSQL_ROOT_PASSWORD" fi + + rootCreate= + # default root to listen for connections from anywhere + file_env 'MYSQL_ROOT_HOST' '%' + if [ ! -z "$MYSQL_ROOT_HOST" -a "$MYSQL_ROOT_HOST" != 'localhost' ]; then + # no, we don't care if read finds a terminating character in this heredoc + # https://unix.stackexchange.com/questions/265149/why-is-set-o-errexit-breaking-this-read-heredoc-expression/265151#265151 + read -r -d '' rootCreate <<-EOSQL || true + CREATE USER 'root'@'${MYSQL_ROOT_HOST}' IDENTIFIED BY '${MYSQL_ROOT_PASSWORD}' ; + GRANT ALL ON *.* TO 'root'@'${MYSQL_ROOT_HOST}' WITH GRANT OPTION ; + EOSQL + fi + "${mysql[@]}" <<-EOSQL -- What's done in this file shouldn't be replicated -- or products like mysql-fabric won't work SET @@SESSION.SQL_LOG_BIN=0; - DELETE FROM mysql.user ; - CREATE USER 'root'@'%' IDENTIFIED BY '${MYSQL_ROOT_PASSWORD}' ; - GRANT ALL ON *.* TO 'root'@'%' WITH GRANT OPTION ; + DELETE FROM mysql.user WHERE user NOT IN ('mysql.sys', 'mysqlxsys', 'root') OR host NOT IN ('localhost') ; + SET PASSWORD FOR 'root'@'localhost'=PASSWORD('${MYSQL_ROOT_PASSWORD}') ; + GRANT ALL ON *.* TO 'root'@'localhost' WITH GRANT OPTION ; + ${rootCreate} DROP DATABASE IF EXISTS test ; FLUSH PRIVILEGES ; EOSQL diff --git a/5.7/Dockerfile b/5.7/Dockerfile index 105bbdb..2ea5498 100644 --- a/5.7/Dockerfile +++ b/5.7/Dockerfile @@ -74,14 +74,12 @@ RUN { \ && rm -rf /var/lib/mysql && mkdir -p /var/lib/mysql /var/run/mysqld \ && chown -R mysql:mysql /var/lib/mysql /var/run/mysqld \ # ensure that /var/run/mysqld (used for socket and lock files) is writable regardless of the UID our mysqld instance ends up having at runtime - && chmod 777 /var/run/mysqld - + && chmod 777 /var/run/mysqld \ # comment out a few problematic configuration values -# don't reverse lookup hostnames, they are usually another container -RUN \ - find /etc/mysql/ -name '*.cnf' -print0 \ + && find /etc/mysql/ -name '*.cnf' -print0 \ | xargs -0 grep -lZE '^(bind-address|log)' \ - | xargs -0 sed -Ei 's/^(bind-address|log)/#&/' \ + | xargs -rt -0 sed -Ei 's/^(bind-address|log)/#&/' \ +# don't reverse lookup hostnames, they are usually another container && echo '[mysqld]\nskip-host-cache\nskip-name-resolve' > /etc/mysql/conf.d/docker.cnf VOLUME ["/var/lib/mysql", "/var/log/mysql"] diff --git a/5.7/docker-entrypoint.sh b/5.7/docker-entrypoint.sh index e4548d4..62b1d15 100755 --- a/5.7/docker-entrypoint.sh +++ b/5.7/docker-entrypoint.sh @@ -113,14 +113,28 @@ if [ "$1" = 'mysqld' -a -z "$wantHelp" ]; then export MYSQL_ROOT_PASSWORD="$(pwgen -1 32)" echo "GENERATED ROOT PASSWORD: $MYSQL_ROOT_PASSWORD" fi + + rootCreate= + # default root to listen for connections from anywhere + file_env 'MYSQL_ROOT_HOST' '%' + if [ ! -z "$MYSQL_ROOT_HOST" -a "$MYSQL_ROOT_HOST" != 'localhost' ]; then + # no, we don't care if read finds a terminating character in this heredoc + # https://unix.stackexchange.com/questions/265149/why-is-set-o-errexit-breaking-this-read-heredoc-expression/265151#265151 + read -r -d '' rootCreate <<-EOSQL || true + CREATE USER 'root'@'${MYSQL_ROOT_HOST}' IDENTIFIED BY '${MYSQL_ROOT_PASSWORD}' ; + GRANT ALL ON *.* TO 'root'@'${MYSQL_ROOT_HOST}' WITH GRANT OPTION ; + EOSQL + fi + "${mysql[@]}" <<-EOSQL -- What's done in this file shouldn't be replicated -- or products like mysql-fabric won't work SET @@SESSION.SQL_LOG_BIN=0; - DELETE FROM mysql.user ; - CREATE USER 'root'@'%' IDENTIFIED BY '${MYSQL_ROOT_PASSWORD}' ; - GRANT ALL ON *.* TO 'root'@'%' WITH GRANT OPTION ; + DELETE FROM mysql.user WHERE user NOT IN ('mysql.sys', 'mysqlxsys', 'root') OR host NOT IN ('localhost') ; + SET PASSWORD FOR 'root'@'localhost'=PASSWORD('${MYSQL_ROOT_PASSWORD}') ; + GRANT ALL ON *.* TO 'root'@'localhost' WITH GRANT OPTION ; + ${rootCreate} DROP DATABASE IF EXISTS test ; FLUSH PRIVILEGES ; EOSQL diff --git a/Dockerfile.template b/Dockerfile.template index 3c8544e..62584fa 100644 --- a/Dockerfile.template +++ b/Dockerfile.template @@ -74,14 +74,12 @@ RUN { \ && rm -rf /var/lib/mysql && mkdir -p /var/lib/mysql /var/run/mysqld \ && chown -R mysql:mysql /var/lib/mysql /var/run/mysqld \ # ensure that /var/run/mysqld (used for socket and lock files) is writable regardless of the UID our mysqld instance ends up having at runtime - && chmod 777 /var/run/mysqld - + && chmod 777 /var/run/mysqld \ # comment out a few problematic configuration values -# don't reverse lookup hostnames, they are usually another container -RUN \ - find /etc/mysql/ -name '*.cnf' -print0 \ + && find /etc/mysql/ -name '*.cnf' -print0 \ | xargs -0 grep -lZE '^(bind-address|log)' \ - | xargs -0 sed -Ei 's/^(bind-address|log)/#&/' \ + | xargs -rt -0 sed -Ei 's/^(bind-address|log)/#&/' \ +# don't reverse lookup hostnames, they are usually another container && echo '[mysqld]\nskip-host-cache\nskip-name-resolve' > /etc/mysql/conf.d/docker.cnf VOLUME ["/var/lib/mysql", "/var/log/mysql"]