The base issue stems from Docker Desktop for Windows' decision about how to translate Windows file permissions to Linux permissions-
Permissions errors on data directories for shared volumes
When sharing files from Windows, Docker Desktop sets permissions on shared volumes to a default value of 0777 (read, write, execute permissions for user and for group).
The default permissions on shared volumes are not configurable. If you are working with applications that require permissions different from the shared volume defaults at container runtime, you need to either use non-host-mounted volumes or find a way to make the applications work with the default file permissions.
Here is MariaDB's current documentation on how to provide a custom configuration file-
Using a custom MariaDB configuration file
The startup configuration is specified in the file /etc/mysql/my.cnf, and that file in turn includes any files found in the /etc/mysql/conf.d directory that end with .cnf. Settings in files in this directory will augment and/or override settings in /etc/mysql/my.cnf. If you want to use a customized MariaDB configuration, you can create your alternative configuration file in a directory on the host machine and then mount that directory location as /etc/mysql/conf.d inside the mariadb container.
When following this procedure, users will get a warning like the below-
Warning: World-writable config file '/etc/mysql/conf.d/config-file.cnf' is ignored
Note this warning does not stop the container from launching. Instead, it results in the custom configuration file(s) not being kept and therefore not being used or loaded by the MariaDB instance. Especially when deploying via docker compose, it's easy for the warning to get lost in other log output, and this can often confuse users into thinking their custom configuration is applied and working when, in fact, it is not.
While there are many proposed work-arounds, the most reliable work-around I have found is to:
Mount the configuration file folder to a different target directory than MariaDB Docker image's documentation recommends
Mount that directory as a volume
Hijack the MariaDB Docker image's COMMAND to manually cp the mounted files into place and chmod such files to correct permissions, and to then call docker-entrypoint.sh mariadbd
Below is a snippet from a docker-compose.yml which handles this-
The only problem this introduces is directly modifying the mounted file(s) may be problematic given Docker is maintaining an active link between the file outside the VM and the file inside the VM. It may make the most sense to just add a feature and update documentation to recommend Windows Docker users mount /etc/mysql/conf.windows.d/ instead and MariaDB's Docker implementation could just check if that directory exists, and if it does, just copy the contents of that directory to the target /etc/mysql/conf.d/ and ensure correct permissions post-copy.
Tested successfully on Windows Docker Desktop by changing config mounts to RO. There is an aspect that GUI cannot specify RO mounts, on on the commandline.
Alternate/complementary implementations:
remove check entirely. Does any other product actually impose the same conditions (except MySQL)?
remove the ignoring of writeable files, but leave a warning. If we do this, in a non-stable branch, maybe we can fix the race condition from stat to open too.
add a warning in the entrypoint recommending RO mounts, but this feels like imposing user configuration on a scenario that isn't a problem.
add a server config option to ignore permissions and put this in the default container configuration (though I'm trying to move back to a default configuration because why should MariaDB in a container be any different from outside).
Daniel Black
added a comment - Tested successfully on Windows Docker Desktop by changing config mounts to RO. There is an aspect that GUI cannot specify RO mounts, on on the commandline.
Alternate/complementary implementations:
remove check entirely. Does any other product actually impose the same conditions (except MySQL)?
remove the ignoring of writeable files, but leave a warning. If we do this, in a non-stable branch, maybe we can fix the race condition from stat to open too.
add a warning in the entrypoint recommending RO mounts, but this feels like imposing user configuration on a scenario that isn't a problem.
add a server config option to ignore permissions and put this in the default container configuration (though I'm trying to move back to a default configuration because why should MariaDB in a container be any different from outside).
People
Daniel Black
Rob Schwyzer (Inactive)
Votes:
2Vote for this issue
Watchers:
4Start watching this issue
Dates
Created:
Updated:
Resolved:
Git Integration
Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.
{"report":{"fcp":819.2999999523163,"ttfb":197.70000004768372,"pageVisibility":"visible","entityId":105015,"key":"jira.project.issue.view-issue","isInitial":true,"threshold":1000,"elementTimings":{},"userDeviceMemory":8,"userDeviceProcessors":64,"apdex":1,"journeyId":"b26ed4cc-00cf-4eb8-8386-46dfa1c8e67c","navigationType":0,"readyForUser":897.7999999523163,"redirectCount":0,"resourceLoadedEnd":536.1000001430511,"resourceLoadedStart":203.20000004768372,"resourceTiming":[{"duration":15.900000095367432,"initiatorType":"link","name":"https://jira.mariadb.org/s/2c21342762a6a02add1c328bed317ffd-CDN/lu2bu7/820016/12ta74/0a8bac35585be7fc6c9cc5a0464cd4cf/_/download/contextbatch/css/_super/batch.css","startTime":203.20000004768372,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":203.20000004768372,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":219.10000014305115,"responseStart":0,"secureConnectionStart":0},{"duration":17.299999952316284,"initiatorType":"link","name":"https://jira.mariadb.org/s/7ebd35e77e471bc30ff0eba799ebc151-CDN/lu2bu7/820016/12ta74/8679b4946efa1a0bb029a3a22206fb5d/_/download/contextbatch/css/jira.browse.project,project.issue.navigator,jira.view.issue,jira.general,jira.global,atl.general,-_super/batch.css?agile_global_admin_condition=true&jag=true&jira.create.linked.issue=true&slack-enabled=true","startTime":203.40000009536743,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":203.40000009536743,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":220.70000004768372,"responseStart":0,"secureConnectionStart":0},{"duration":221.20000004768372,"initiatorType":"script","name":"https://jira.mariadb.org/s/fbf975c0cce4b1abf04784eeae9ba1f4-CDN/lu2bu7/820016/12ta74/0a8bac35585be7fc6c9cc5a0464cd4cf/_/download/contextbatch/js/_super/batch.js?locale=en","startTime":203.5,"connectEnd":203.5,"connectStart":203.5,"domainLookupEnd":203.5,"domainLookupStart":203.5,"fetchStart":203.5,"redirectEnd":0,"redirectStart":0,"requestStart":221.40000009536743,"responseEnd":424.7000000476837,"responseStart":251.60000014305115,"secureConnectionStart":203.5},{"duration":332.5,"initiatorType":"script","name":"https://jira.mariadb.org/s/099b33461394b8015fc36c0a4b96e19f-CDN/lu2bu7/820016/12ta74/8679b4946efa1a0bb029a3a22206fb5d/_/download/contextbatch/js/jira.browse.project,project.issue.navigator,jira.view.issue,jira.general,jira.global,atl.general,-_super/batch.js?agile_global_admin_condition=true&jag=true&jira.create.linked.issue=true&locale=en&slack-enabled=true","startTime":203.60000014305115,"connectEnd":203.60000014305115,"connectStart":203.60000014305115,"domainLookupEnd":203.60000014305115,"domainLookupStart":203.60000014305115,"fetchStart":203.60000014305115,"redirectEnd":0,"redirectStart":0,"requestStart":225.10000014305115,"responseEnd":536.1000001430511,"responseStart":254.79999995231628,"secureConnectionStart":203.60000014305115},{"duration":56.40000009536743,"initiatorType":"script","name":"https://jira.mariadb.org/s/94c15bff32baef80f4096a08aceae8bc-CDN/lu2bu7/820016/12ta74/c92c0caa9a024ae85b0ebdbed7fb4bd7/_/download/contextbatch/js/atl.global,-_super/batch.js?locale=en","startTime":203.79999995231628,"connectEnd":203.79999995231628,"connectStart":203.79999995231628,"domainLookupEnd":203.79999995231628,"domainLookupStart":203.79999995231628,"fetchStart":203.79999995231628,"redirectEnd":0,"redirectStart":0,"requestStart":228.40000009536743,"responseEnd":260.2000000476837,"responseStart":257.7000000476837,"secureConnectionStart":203.79999995231628},{"duration":59,"initiatorType":"script","name":"https://jira.mariadb.org/s/d41d8cd98f00b204e9800998ecf8427e-CDN/lu2bu7/820016/12ta74/1.0/_/download/batch/jira.webresources:calendar-en/jira.webresources:calendar-en.js","startTime":203.79999995231628,"connectEnd":203.79999995231628,"connectStart":203.79999995231628,"domainLookupEnd":203.79999995231628,"domainLookupStart":203.79999995231628,"fetchStart":203.79999995231628,"redirectEnd":0,"redirectStart":0,"requestStart":228.90000009536743,"responseEnd":262.7999999523163,"responseStart":258.7000000476837,"secureConnectionStart":203.79999995231628},{"duration":59.200000047683716,"initiatorType":"script","name":"https://jira.mariadb.org/s/d41d8cd98f00b204e9800998ecf8427e-CDN/lu2bu7/820016/12ta74/1.0/_/download/batch/jira.webresources:calendar-localisation-moment/jira.webresources:calendar-localisation-moment.js","startTime":204,"connectEnd":204,"connectStart":204,"domainLookupEnd":204,"domainLookupStart":204,"fetchStart":204,"redirectEnd":0,"redirectStart":0,"requestStart":229.40000009536743,"responseEnd":263.2000000476837,"responseStart":260.40000009536743,"secureConnectionStart":204},{"duration":20.899999856948853,"initiatorType":"link","name":"https://jira.mariadb.org/s/b04b06a02d1959df322d9cded3aeecc1-CDN/lu2bu7/820016/12ta74/a2ff6aa845ffc9a1d22fe23d9ee791fc/_/download/contextbatch/css/jira.global.look-and-feel,-_super/batch.css","startTime":204.10000014305115,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":204.10000014305115,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":225,"responseStart":0,"secureConnectionStart":0},{"duration":22.5,"initiatorType":"link","name":"https://jira.mariadb.org/s/3ac36323ba5e4eb0af2aa7ac7211b4bb-CDN/lu2bu7/820016/12ta74/d176f0986478cc64f24226b3d20c140d/_/download/contextbatch/css/com.atlassian.jira.projects.sidebar.init,-_super,-project.issue.navigator,-jira.view.issue/batch.css?jira.create.linked.issue=true","startTime":204.20000004768372,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":204.20000004768372,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":226.70000004768372,"responseStart":0,"secureConnectionStart":0},{"duration":59.200000047683716,"initiatorType":"script","name":"https://jira.mariadb.org/rest/api/1.0/shortcuts/820016/47140b6e0a9bc2e4913da06536125810/shortcuts.js?context=issuenavigation&context=issueaction","startTime":204.20000004768372,"connectEnd":204.20000004768372,"connectStart":204.20000004768372,"domainLookupEnd":204.20000004768372,"domainLookupStart":204.20000004768372,"fetchStart":204.20000004768372,"redirectEnd":0,"redirectStart":0,"requestStart":229.90000009536743,"responseEnd":263.40000009536743,"responseStart":261.40000009536743,"secureConnectionStart":204.20000004768372},{"duration":71.60000014305115,"initiatorType":"script","name":"https://jira.mariadb.org/s/3339d87fa2538a859872f2df449bf8d0-CDN/lu2bu7/820016/12ta74/d176f0986478cc64f24226b3d20c140d/_/download/contextbatch/js/com.atlassian.jira.projects.sidebar.init,-_super,-project.issue.navigator,-jira.view.issue/batch.js?jira.create.linked.issue=true&locale=en","startTime":204.29999995231628,"connectEnd":204.29999995231628,"connectStart":204.29999995231628,"domainLookupEnd":204.29999995231628,"domainLookupStart":204.29999995231628,"fetchStart":204.29999995231628,"redirectEnd":0,"redirectStart":0,"requestStart":230.70000004768372,"responseEnd":275.90000009536743,"responseStart":272.90000009536743,"secureConnectionStart":204.29999995231628},{"duration":326.40000009536743,"initiatorType":"script","name":"https://jira.mariadb.org/s/d41d8cd98f00b204e9800998ecf8427e-CDN/lu2bu7/820016/12ta74/1.0/_/download/batch/jira.webresources:bigpipe-js/jira.webresources:bigpipe-js.js","startTime":205.20000004768372,"connectEnd":205.20000004768372,"connectStart":205.20000004768372,"domainLookupEnd":205.20000004768372,"domainLookupStart":205.20000004768372,"fetchStart":205.20000004768372,"redirectEnd":0,"redirectStart":0,"requestStart":271.7000000476837,"responseEnd":531.6000001430511,"responseStart":527.2999999523163,"secureConnectionStart":205.20000004768372},{"duration":322.2000000476837,"initiatorType":"script","name":"https://jira.mariadb.org/s/d41d8cd98f00b204e9800998ecf8427e-CDN/lu2bu7/820016/12ta74/1.0/_/download/batch/jira.webresources:bigpipe-init/jira.webresources:bigpipe-init.js","startTime":209.70000004768372,"connectEnd":209.70000004768372,"connectStart":209.70000004768372,"domainLookupEnd":209.70000004768372,"domainLookupStart":209.70000004768372,"fetchStart":209.70000004768372,"redirectEnd":0,"redirectStart":0,"requestStart":273.7999999523163,"responseEnd":531.9000000953674,"responseStart":528.6000001430511,"secureConnectionStart":209.70000004768372},{"duration":220.79999995231628,"initiatorType":"xmlhttprequest","name":"https://jira.mariadb.org/rest/webResources/1.0/resources","startTime":572.4000000953674,"connectEnd":572.4000000953674,"connectStart":572.4000000953674,"domainLookupEnd":572.4000000953674,"domainLookupStart":572.4000000953674,"fetchStart":572.4000000953674,"redirectEnd":0,"redirectStart":0,"requestStart":749.2999999523163,"responseEnd":793.2000000476837,"responseStart":787.7000000476837,"secureConnectionStart":572.4000000953674},{"duration":90,"initiatorType":"script","name":"https://www.google-analytics.com/analytics.js","startTime":811.2999999523163,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":811.2999999523163,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":901.2999999523163,"responseStart":0,"secureConnectionStart":0},{"duration":108.29999995231628,"initiatorType":"xmlhttprequest","name":"https://jira.mariadb.org/rest/webResources/1.0/resources","startTime":832.7000000476837,"connectEnd":832.7000000476837,"connectStart":832.7000000476837,"domainLookupEnd":832.7000000476837,"domainLookupStart":832.7000000476837,"fetchStart":832.7000000476837,"redirectEnd":0,"redirectStart":0,"requestStart":907.7999999523163,"responseEnd":941,"responseStart":940,"secureConnectionStart":832.7000000476837}],"fetchStart":0,"domainLookupStart":27,"domainLookupEnd":28,"connectStart":28,"connectEnd":47,"secureConnectionStart":36,"requestStart":48,"responseStart":198,"responseEnd":203,"domLoading":201,"domInteractive":994,"domContentLoadedEventStart":994,"domContentLoadedEventEnd":1038,"domComplete":1269,"loadEventStart":1269,"loadEventEnd":1270,"userAgent":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)","marks":[{"name":"bigPipe.sidebar-id.start","time":970.5},{"name":"bigPipe.sidebar-id.end","time":971.2999999523163},{"name":"bigPipe.activity-panel-pipe-id.start","time":971.5},{"name":"bigPipe.activity-panel-pipe-id.end","time":972.5},{"name":"activityTabFullyLoaded","time":1054.9000000953674}],"measures":[],"correlationId":"e802de1b6647c3","effectiveType":"4g","downlink":10,"rtt":0,"serverDuration":76,"dbReadsTimeInMs":11,"dbConnsTimeInMs":17,"applicationHash":"9d11dbea5f4be3d4cc21f03a88dd11d8c8687422","experiments":[]}}
rob.schwyzer@mariadb.com what do you think of https://github.com/MariaDB/server/pull/2669 to support RO mount points.