Run MySQL a prefilled docker container as random (non-root) linux user?

I am trying to create an OpenShift compliant prefilled MySQL container image.

Running the container with a specified user is (sadly) not an option for us.

This is a problem since OpenShift simply creates some random UID without a username so setting a username at runtime with a script before starting the MySQL service is not an option.

Is there any way to get MySQL to run with any random UID in a docker container?

edit: The idea behind this question is being able to start a MySQL container like this Dockerfile for randomusermysql:example

FROM mysql:5.7.22  #IMPORTANT: MySQL Container runs init in alphanumerical order! COPY src/some.sql /docker-entrypoint-initdb.d/  ENV MYSQL_ROOT_PASSWORD='somepw'  RUN mkdir -p /var/lib/mysql2 && \     chown -R mysql:mysql /var/lib/mysql2 && \     chmod -R 777 /var/lib/mysql2 && \     sed -i 's|/var/lib/mysql|/var/lib/mysql2|g' /etc/mysql/mysql.conf.d/mysqld.cnf && \     sed -i 's|exec "$@"||g' /entrypoint.sh && \     /entrypoint.sh mysqld && \     chmod -R 777 /var/lib/mysql2/ && \     chown -R mysql:mysql /var/lib/mysql2 && \     find /var/lib/mysql2/ -name "*.cnf" -exec chmod 775 {} \; && \     echo 'exec "$@"' >> /entrypoint.sh 

Then starting it like this

docker run -u 123456789 randomusermysql:example 

Results in the following error when starting the container

2018-05-22T11:39:35.084034Z 0 [ERROR] Fatal error: Can't open and lock privilege tables: Table storage engine for 'user' doesn't have this option 2018-05-22T11:39:35.084235Z 0 [ERROR] Aborting 

There is no possibility of passing the user as docker ENV when starting the container

edit2: Bounty text is incorrect.
Corrected bounty statement:
A solution is needed with a prefilled MySQL database without just copying the dump files into /docker-entrypoint-initdb.d directory!

1 Answers

Answers 1

The problem is that if you pre-create the database files as part of the image in the required location, is that they will have user the same as the Dockerfile created them. You will not know in advance what the user is and so can't match what the database may be started as, causing MySQL to fail on startup because the directory owning the database files is not the same as what it is being started as.

The only solution I have seen to this is to add the database files into the image in a tar file at some location. In the startup command for the database, create the directory for the database and unpack the tar file into it. This way the directory and the files will be the user that MySQL runs as.

Note that you will want to make the parent directory of where the database directory is to be created, group root and writable by group so you can create the database directory when image run as arbitrary user ID for which there is no passwd file entry. In that case, the group ID will fallback to being root group and so that will allow the database directory to be created.

Read More

Why does redirecting from HTTPS to HTTP fail in this Rails 4 app (OpenShift)?

When the user is on HTTP, I can successfully redirect him to a HTTPS (SSL) variant like so:

redirect_to { protocol: 'https://', domain: 'ssl.tld' }

However, when I want to do the reverse, it creates an infinite redirection loop. I've tried several variants. To mention some:

redirect_to { protocol: 'http://', domain: 'nonssl.tld' }

redirect_to "http://nonssl.tld#{request.fullpath}"

The loop, according to the log:

000.000.000.000 - - [21/Apr/2016:18:50:04 -0100] "GET /en HTTP/1.1" 302 887 "https://ssl.tld/en/users/sign_in" "= THE_USER_AGENT_HERE"

Whereas https://ssl.tld/en/users/sign_in apparantly is the referrer/the current page before redirection.

I wonder why the GET shows a path as opposed to a URL - especially given that redirect_to "http://nonssl.tld#{request.fullpath}" should explicitly be considered an absolute URL, according to the docs.

---

UPDATE Here is the relevant part from the application_controller's before_action:

exceptions = ['errors', 'subscriptions', 'users'] ssl_is_mandatory = ! exceptions.include?(controller_name) currently_on_ssl = request.ssl?  if currently_on_ssl   if !current_user && !ssl_is_mandatory     logger.debug "#{__method__}: Visitor currently on SSL, but SSL not desired. Redirecting to non_ssl"     redirect_to "http://my.domain#{request.fullpath}"   end  else   if current_user || ssl_is_mandatory     logger.debug "#{__method__}: Currently on no-SSL, but user in session or SSL mandatory. Redirecting to ssl"     redirect_to { protocol: 'https://', domain: 'my.ssldomain' }   end end 

0 Answers

Read More