113 lines
3.7 KiB
Docker
113 lines
3.7 KiB
Docker
FROM oraclelinux:9-slim-fips
|
|
|
|
RUN set -eux; \
|
|
groupadd --system --gid 999 mysql; \
|
|
useradd --system --uid 999 --gid 999 --home-dir /var/lib/mysql --no-create-home mysql
|
|
|
|
COPY gosu-amd64 /usr/local/bin/gosu
|
|
RUN set -eux; \
|
|
chmod +x /usr/local/bin/gosu; \
|
|
gosu --version; \
|
|
gosu nobody true
|
|
|
|
# add gosu for easy step-down from root
|
|
# https://github.com/tianon/gosu/releases
|
|
# ENV GOSU_VERSION 1.19
|
|
# RUN set -eux; \
|
|
ENV MYSQL_MAJOR=8.4
|
|
|
|
RUN set -eux; \
|
|
microdnf update -y; \
|
|
microdnf upgrade -y;
|
|
|
|
RUN set -eux; \
|
|
microdnf install -y \
|
|
bzip2 \
|
|
gzip \
|
|
openssl \
|
|
xz \
|
|
zstd \
|
|
findutils
|
|
|
|
RUN set -eux; \
|
|
key='BCA4 3417 C3B4 85DD 128E C6D4 B7B3 B788 A8D3 785C'; \
|
|
export GNUPGHOME="$(mktemp -d)"; \
|
|
gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key"; \
|
|
gpg --batch --export --armor "$key" > /etc/pki/rpm-gpg/RPM-GPG-KEY-mysql; \
|
|
rm -rf "$GNUPGHOME"
|
|
|
|
|
|
RUN set -eu; \
|
|
{ \
|
|
echo '[mysql8.4-server-minimal]'; \
|
|
echo 'name=MySQL 8.4 Server Minimal'; \
|
|
echo 'enabled=1'; \
|
|
echo 'baseurl=https://repo.mysql.com/yum/mysql-8.4-community/docker/el/9/$basearch/'; \
|
|
echo 'gpgcheck=1'; \
|
|
echo 'gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-mysql'; \
|
|
# https://github.com/docker-library/mysql/pull/680#issuecomment-825930524
|
|
echo 'module_hotfixes=true'; \
|
|
} | tee /etc/yum.repos.d/mysql-community-minimal.repo
|
|
|
|
RUN set -eux; \
|
|
microdnf install -y "mysql-community-server-minimal"; \
|
|
# the "socket" value in the Oracle packages is set to "/var/lib/mysql" which isn't a great place for the socket (we want it in "/var/run/mysqld" instead)
|
|
# https://github.com/docker-library/mysql/pull/680#issuecomment-636121520
|
|
grep -F 'socket=/var/lib/mysql/mysql.sock' /etc/my.cnf; \
|
|
sed -i 's!^socket=.*!socket=/var/run/mysqld/mysqld.sock!' /etc/my.cnf; \
|
|
grep -F 'socket=/var/run/mysqld/mysqld.sock' /etc/my.cnf; \
|
|
{ echo '[client]'; echo 'socket=/var/run/mysqld/mysqld.sock'; } >> /etc/my.cnf; \
|
|
\
|
|
# make sure users dumping files in "/etc/mysql/conf.d" still works
|
|
! grep -F '!includedir' /etc/my.cnf; \
|
|
{ echo; echo '!includedir /etc/mysql/conf.d/'; } >> /etc/my.cnf; \
|
|
mkdir -p /etc/mysql/conf.d; \
|
|
# ensure these directories exist and have useful permissions
|
|
# the rpm package has different opinions on the mode of `/var/run/mysqld`, so this needs to be after install
|
|
mkdir -p /var/lib/mysql /var/run/mysqld; \
|
|
chown mysql:mysql /var/lib/mysql /var/run/mysqld; \
|
|
# ensure that /var/run/mysqld (used for socket and lock files) is writable regardless of the UID our mysqld instance ends up having at runtime
|
|
chmod 1777 /var/lib/mysql /var/run/mysqld; \
|
|
\
|
|
mkdir /docker-entrypoint-initdb.d; \
|
|
\
|
|
mysqld --version; \
|
|
mysql --version
|
|
|
|
RUN set -eu; \
|
|
{ \
|
|
echo '[mysql-tools-community]'; \
|
|
echo 'name=MySQL Tools Community'; \
|
|
echo 'baseurl=https://repo.mysql.com/yum/mysql-tools-8.4-community/el/9/$basearch/'; \
|
|
echo 'enabled=1'; \
|
|
echo 'gpgcheck=1'; \
|
|
echo 'gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-mysql'; \
|
|
# https://github.com/docker-library/mysql/pull/680#issuecomment-825930524
|
|
echo 'module_hotfixes=true'; \
|
|
} | tee /etc/yum.repos.d/mysql-community-tools.repo
|
|
|
|
# 漏洞问题先不安装
|
|
# RUN set -eux; \
|
|
# microdnf install -y "mysql-shell"; \
|
|
# mysqlsh --version
|
|
|
|
RUN set -eux; \
|
|
microdnf clean all ;
|
|
|
|
VOLUME /var/lib/mysql
|
|
|
|
COPY docker-entrypoint.sh /usr/local/bin/
|
|
RUN chmod +x /usr/local/bin/docker-entrypoint.sh
|
|
|
|
ENTRYPOINT ["docker-entrypoint.sh"]
|
|
|
|
EXPOSE 3306 33060
|
|
CMD ["mysqld"]
|
|
|
|
RUN set -eux; \
|
|
rpm -e --nodeps glib2 libssh libssh-config libcurl curl
|
|
|
|
# docker build -t registry.cn-shanghai.aliyuncs.com/hub_z/mysql:8.4 .
|
|
# docker push registry.cn-shanghai.aliyuncs.com/hub_z/mysql:8.4
|
|
# syft --scope squashed registry.cn-shanghai.aliyuncs.com/hub_z/mysql:8.4 -o spdx-json=mysql.json
|