[MDEV-27038] Custom configuration file procedure does not work with Docker Desktop for Windows 10+ Created: 2021-11-12  Updated: 2023-07-11  Resolved: 2023-07-11

Status: Closed
Project: MariaDB Server
Component/s: Docker
Fix Version/s: 10.4.31, 10.5.22, 10.6.15, 10.9.8, 10.10.6, 10.11.5, 11.0.3, 11.1.2, 11.2.1

Type: Task Priority: Minor
Reporter: Rob Schwyzer Assignee: Daniel Black
Resolution: Fixed Votes: 2
Labels: Windows


 Description   

Note this, general issue exists in MySQL's Docker implementation as well-
https://stackoverflow.com/questions/35367935/mysql-in-docker-on-windows-world-writable-files-ignored

The base issue stems from Docker Desktop for Windows' decision about how to translate Windows file permissions to Linux permissions-

Permissions errors on data directories for shared volumes

When sharing files from Windows, Docker Desktop sets permissions on shared volumes to a default value of 0777 (read, write, execute permissions for user and for group).

The default permissions on shared volumes are not configurable. If you are working with applications that require permissions different from the shared volume defaults at container runtime, you need to either use non-host-mounted volumes or find a way to make the applications work with the default file permissions.

-https://docs.docker.com/desktop/windows/troubleshoot/#volumes

Here is MariaDB's current documentation on how to provide a custom configuration file-

Using a custom MariaDB configuration file

The startup configuration is specified in the file /etc/mysql/my.cnf, and that file in turn includes any files found in the /etc/mysql/conf.d directory that end with .cnf. Settings in files in this directory will augment and/or override settings in /etc/mysql/my.cnf. If you want to use a customized MariaDB configuration, you can create your alternative configuration file in a directory on the host machine and then mount that directory location as /etc/mysql/conf.d inside the mariadb container.

-https://hub.docker.com/_/mariadb

When following this procedure, users will get a warning like the below-

Warning: World-writable config file '/etc/mysql/conf.d/config-file.cnf' is ignored

Note this warning does not stop the container from launching. Instead, it results in the custom configuration file(s) not being kept and therefore not being used or loaded by the MariaDB instance. Especially when deploying via docker compose, it's easy for the warning to get lost in other log output, and this can often confuse users into thinking their custom configuration is applied and working when, in fact, it is not.

While there are many proposed work-arounds, the most reliable work-around I have found is to:

  1. Mount the configuration file folder to a different target directory than MariaDB Docker image's documentation recommends
  2. Mount that directory as a volume
  3. Hijack the MariaDB Docker image's COMMAND to manually cp the mounted files into place and chmod such files to correct permissions, and to then call docker-entrypoint.sh mariadbd

Below is a snippet from a docker-compose.yml which handles this-

    volumes:
      - ./mariadb-config:/etc/mysql/config.d
    command: >
      bash -c "
      cp /etc/mysql/config.d/* /etc/mysql/conf.d/.
      && chmod 644 /etc/mysql/conf.d/*.cnf
      && /usr/local/bin/docker-entrypoint.sh mariadbd
      "

Given the permissions of the file(s) a user supplied to MariaDB's Docker image for the purposes of configuration should never need to be 777, it might make more sense to modify https://github.com/MariaDB/mariadb-docker/blob/master/Dockerfile.template or https://github.com/MariaDB/mariadb-docker/blob/master/docker-entrypoint.sh to detect and gracefully handle when 777 or other, non-viable permission masks are detected for such files.

The only problem this introduces is directly modifying the mounted file(s) may be problematic given Docker is maintaining an active link between the file outside the VM and the file inside the VM. It may make the most sense to just add a feature and update documentation to recommend Windows Docker users mount /etc/mysql/conf.windows.d/ instead and MariaDB's Docker implementation could just check if that directory exists, and if it does, just copy the contents of that directory to the target /etc/mysql/conf.d/ and ensure correct permissions post-copy.



 Comments   
Comment by Daniel Black [ 2023-06-15 ]

rob.schwyzer@mariadb.com what do you think of https://github.com/MariaDB/server/pull/2669 to support RO mount points.

Comment by Daniel Black [ 2023-06-16 ]

Tested successfully on Windows Docker Desktop by changing config mounts to RO. There is an aspect that GUI cannot specify RO mounts, on on the commandline.

Alternate/complementary implementations:

  • remove check entirely. Does any other product actually impose the same conditions (except MySQL)?
  • remove the ignoring of writeable files, but leave a warning. If we do this, in a non-stable branch, maybe we can fix the race condition from stat to open too.
  • add a warning in the entrypoint recommending RO mounts, but this feels like imposing user configuration on a scenario that isn't a problem.
  • add a server config option to ignore permissions and put this in the default container configuration (though I'm trying to move back to a default configuration because why should MariaDB in a container be any different from outside).
Generated at Thu Feb 08 09:49:52 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.