keep backward compatibility with debian images

[delgod]

asked in this discussion -
docker-library/percona#68 (comment)

[EvgeniyPatlan]

lgtm

[tianon]

Using sudo is definitely going to get some eyebrow raises in review at https://github.com/docker-library/official-images -- having setuid binaries is a much bigger security issue than initially running as root and stepping down during startup (especially with such a permissive configuration like NOPASSWD: ALL).

When you consider that no-new-privileges works with the "start as root, step down to non-root during startup" but does not work with "start as non-root and explicitly gain privileges during startup", it becomes even more compelling IMO (since you then get a pretty firm guarantee that the container can't become root again without a pretty severe kernel level exploit).

[glensc]

please ensure this approach also will supports --user argument:

https://github.com/docker-library/docs/tree/edb189b2ee5fa42b48334794c6f6ea4aba763be9/mysql#running-as-an-arbitrary-user

If you know the permissions of your directory are already set appropriately (such as running against an existing database, as described above) or you have need of running mysqld with a specific UID/GID, it is possible to invoke this image with --user set to any value (other than root/0) in order to achieve the desired access/configuration:

$ mkdir data
$ ls -lnd data
drwxr-xr-x 2 1000 1000 4096 Aug 27 15:54 data
$ docker run -v "$PWD/data":/var/lib/mysql --user 1000:1000 --name some-mysql -e MYSQL_ROOT_PASSWORD=my-secret-pw -d mysql:tag

@tianon i also noticed the sudo use here, but as they change user in Dockerfile, rather in ENTRYPOINT, they have not much other choices.

[delgod]

Hi @tianon,
Yes, you right. I have removed sudo command and created another revision, which has UID identical to current DockerHub UID.

Hi @glensc,
We are not going to support --user argument.
Yes, I understand why it is needed, but we don't want to run ENTRYPOINT from root privileges and also don't want to use sudo.
I hope for your understanding. Security is always a hard choice, and it is better to be blamed due to lack of usability than lack of security.
in the new version of this review, I am using 999 UID (as the initial dockerhub image)

[glensc]

minor nitpick: you can user -o mysql -g root as the user/group already created in this very Dockerfile.

[delgod]

fixed

[glensc]

as the user is created in this very dockerfile, i find it more elegant to use name than uid

[delgod]

fixed

[glensc]

not related to this PR, but you may want to add X for directories, not to rely on previous state or umask:

	&& chmod -R ug+rwX /etc/my.cnf /etc/my.cnf.d

[delgod]

fixed