mysql

  1. FROM debian:stretch-slim
  3. # add our user and group first to make sure their IDs get assigned consistently, regardless of whatever dependencies get added
  4. RUN groupadd -r mysql && useradd -r -g mysql mysql
  6. RUN apt-get update && apt-get install -y --no-install-recommends gnupg dirmngr && rm -rf /var/lib/apt/lists/*
  8. # add gosu for easy step-down from root
  9. ENV GOSU_VERSION 1.7
  10. RUN set -x \
  11.     && apt-get update && apt-get install -y --no-install-recommends ca-certificates wget && rm -rf /var/lib/apt/lists/* \
  12.     && wget -O /usr/local/bin/gosu "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$(dpkg --print-architecture)" \
  13.     && wget -O /usr/local/bin/gosu.asc "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$(dpkg --print-architecture).asc" \
  14.     && export GNUPGHOME="$(mktemp -d)" \
  15.     && gpg --batch --keyserver ha.pool.sks-keyservers.net --recv-keys B42F6819007F00F88E364FD4036A9C25BF357DD4 \
  16.     && gpg --batch --verify /usr/local/bin/gosu.asc /usr/local/bin/gosu \
  17.     && gpgconf --kill all \
  18.     && rm -rf "$GNUPGHOME" /usr/local/bin/gosu.asc \
  19.     && chmod +x /usr/local/bin/gosu \
  20.     && gosu nobody true \
  21.     && apt-get purge -y --auto-remove ca-certificates wget
  23. RUN mkdir /docker-entrypoint-initdb.d
  25. RUN apt-get update && apt-get install -y --no-install-recommends \
  26. # for MYSQL_RANDOM_ROOT_PASSWORD
  27.         pwgen \
  28. # for mysql_ssl_rsa_setup
  29.         openssl \
  30. # FATAL ERROR: please install the following Perl modules before executing /usr/local/mysql/scripts/mysql_install_db:
  31. # File::Basename
  32. # File::Copy
  33. # Sys::Hostname
  34. # Data::Dumper
  35.         perl \
  36.     && rm -rf /var/lib/apt/lists/*
  38. RUN set -ex; \
  39. # gpg: key 5072E1F5: public key "MySQL Release Engineering <mysql-build@oss.oracle.com>" imported
  40.     key='A4A9406876FCBD3C456770C88C718D3B5072E1F5'; \
  41.     export GNUPGHOME="$(mktemp -d)"; \
  42.     gpg --batch --keyserver ha.pool.sks-keyservers.net --recv-keys "$key"; \
  43.     gpg --batch --export "$key" > /etc/apt/trusted.gpg.d/mysql.gpg; \
  44.     gpgconf --kill all; \
  45.     rm -rf "$GNUPGHOME"; \
  46.     apt-key list > /dev/null
  48. ENV MYSQL_MAJOR 5.7
  49. ENV MYSQL_VERSION 5.7.25-1debian9
  51. RUN echo "deb http://repo.mysql.com/apt/debian/ stretch mysql-${MYSQL_MAJOR}" > /etc/apt/sources.list.d/mysql.list
  53. # the "/var/lib/mysql" stuff here is because the mysql-server postinst doesn't have an explicit way to disable the mysql_install_db codepath besides having a database already "configured" (ie, stuff in /var/lib/mysql/mysql)
  54. # also, we set debconf keys to make APT a little quieter
  55. RUN { \
  56.         echo mysql-community-server mysql-community-server/data-dir select ''; \
  57.         echo mysql-community-server mysql-community-server/root-pass password ''; \
  58.         echo mysql-community-server mysql-community-server/re-root-pass password ''; \
  59.         echo mysql-community-server mysql-community-server/remove-test-db select false; \
  60.     } | debconf-set-selections \
  61.     && apt-get update && apt-get install -y mysql-server="${MYSQL_VERSION}" && rm -rf /var/lib/apt/lists/* \
  62.     && rm -rf /var/lib/mysql && mkdir -p /var/lib/mysql /var/run/mysqld \
  63.     && chown -R mysql:mysql /var/lib/mysql /var/run/mysqld \
  64. # ensure that /var/run/mysqld (used for socket and lock files) is writable regardless of the UID our mysqld instance ends up having at runtime
  65.     && chmod 777 /var/run/mysqld \
  66. # comment out a few problematic configuration values
  67.     && find /etc/mysql/ -name '*.cnf' -print0 \
  68.         | xargs -0 grep -lZE '^(bind-address|log)' \
  69.         | xargs -rt -0 sed -Ei 's/^(bind-address|log)/#&/' \
  70. # don't reverse lookup hostnames, they are usually another container
  71.     && echo '[mysqld]\nskip-host-cache\nskip-name-resolve' > /etc/mysql/conf.d/docker.cnf
  73. VOLUME /var/lib/mysql
  75. COPY docker-entrypoint.sh /usr/local/bin/
  76. RUN ln -s usr/local/bin/docker-entrypoint.sh /entrypoint.sh # backwards compat
  77. ENTRYPOINT ["docker-entrypoint.sh"]
  79. EXPOSE 3306 33060
  80. CMD ["mysqld"]
  1. capsule image runc mysql "/usr/local/bin/docker-entrypoint.sh mysqld --user=root" -id=mysql -v /root/mysql/logs:/logs -v /root/mysql/data:/var/lib/mysql -p 3306:3306 -d
  2. capsule exec mysql bash
  3. > show databases;
  4. > create database demo;
  5. > use mysql;
  6. > update user set host='%' where user='root';
  7. > flush privileges;
  8. > exit

error: exec: “/usr/local/bin/docker-entrypoint.sh”: stat /usr/local/bin/docker-entrypoint.sh: permission denied

这里要把—user这种选项的处理逻辑删掉， 因为目前不支持chown。

  1. #!/bin/bash
  2. set -eo pipefail
  3. shopt -s nullglob
  5. # if command starts with an option, prepend mysqld
  6. if [ "${1:0:1}" = '-' ]; then
  7.     set -- mysqld "$@"
  8. fi
  10. # skip setup if they want an option that stops mysqld
  11. wantHelp=
  12. for arg; do
  13.     case "$arg" in
  14.         -'?'|--help|--print-defaults|-V|--version)
  15.             wantHelp=1
  16.             break
  17.             ;;
  18.     esac
  19. done
  21. # usage: file_env VAR [DEFAULT]
  22. #    ie: file_env 'XYZ_DB_PASSWORD' 'example'
  23. # (will allow for "$XYZ_DB_PASSWORD_FILE" to fill in the value of
  24. #  "$XYZ_DB_PASSWORD" from a file, especially for Docker's secrets feature)
  25. file_env() {
  26.     local var="$1"
  27.     local fileVar="${var}_FILE"
  28.     local def="${2:-}"
  29.     if [ "${!var:-}" ] && [ "${!fileVar:-}" ]; then
  30.         echo >&2 "error: both $var and $fileVar are set (but are exclusive)"
  31.         exit 1
  32.     fi
  33.     local val="$def"
  34.     if [ "${!var:-}" ]; then
  35.         val="${!var}"
  36.     elif [ "${!fileVar:-}" ]; then
  37.         val="$(< "${!fileVar}")"
  38.     fi
  39.     export "$var"="$val"
  40.     unset "$fileVar"
  41. }
  43. # usage: process_init_file FILENAME MYSQLCOMMAND...
  44. #    ie: process_init_file foo.sh mysql -uroot
  45. # (process a single initializer file, based on its extension. we define this
  46. # function here, so that initializer scripts (*.sh) can use the same logic,
  47. # potentially recursively, or override the logic used in subsequent calls)
  48. process_init_file() {
  49.     local f="$1"; shift
  50.     local mysql=( "$@" )
  52.     case "$f" in
  53.         *.sh)     echo "$0: running $f"; . "$f" ;;
  54.         *.sql)    echo "$0: running $f"; "${mysql[@]}" < "$f"; echo ;;
  55.         *.sql.gz) echo "$0: running $f"; gunzip -c "$f" | "${mysql[@]}"; echo ;;
  56.         *)        echo "$0: ignoring $f" ;;
  57.     esac
  58.     echo
  59. }
  61. _check_config() {
  62.     toRun=( "$@" --verbose --help )
  63.     if ! errors="$("${toRun[@]}" 2>&1 >/dev/null)"; then
  64.         cat >&2 <<-EOM
  66.             ERROR: mysqld failed while attempting to check config
  67.             command was: "${toRun[*]}"
  69.             $errors
  70.         EOM
  71.         exit 1
  72.     fi
  73. }
  75. # Fetch value from server config
  76. # We use mysqld --verbose --help instead of my_print_defaults because the
  77. # latter only show values present in config files, and not server defaults
  78. _get_config() {
  79.     local conf="$1"; shift
  80.     "$@" --verbose --help --log-bin-index="$(mktemp -u)" 2>/dev/null \
  81.         | awk '$1 == "'"$conf"'" && /^[^ \t]/ { sub(/^[^ \t]+[ \t]+/, ""); print; exit }'
  82.     # match "datadir      /some/path with/spaces in/it here" but not "--xyz=abc\n     datadir (xyz)"
  83. }
  85. if [ "$1" = 'mysqld' -a -z "$wantHelp" ]; then
  86.     # still need to check config, container may have started with --user
  87.     _check_config "$@"
  88.     # Get config
  89.     DATADIR="$(_get_config 'datadir' "$@")"
  91.     if [ ! -d "$DATADIR/mysql" ]; then
  92.         file_env 'MYSQL_ROOT_PASSWORD'
  93.         if [ -z "$MYSQL_ROOT_PASSWORD" -a -z "$MYSQL_ALLOW_EMPTY_PASSWORD" -a -z "$MYSQL_RANDOM_ROOT_PASSWORD" ]; then
  94.             echo >&2 'error: database is uninitialized and password option is not specified '
  95.             echo >&2 '  You need to specify one of MYSQL_ROOT_PASSWORD, MYSQL_ALLOW_EMPTY_PASSWORD and MYSQL_RANDOM_ROOT_PASSWORD'
  96.             exit 1
  97.         fi
  99.         mkdir -p "$DATADIR"
  101.         echo 'Initializing database'
  102.         "$@" --initialize-insecure
  103.         echo 'Database initialized'
  105.         if command -v mysql_ssl_rsa_setup > /dev/null && [ ! -e "$DATADIR/server-key.pem" ]; then
  106.             # https://github.com/mysql/mysql-server/blob/23032807537d8dd8ee4ec1c4d40f0633cd4e12f9/packaging/deb-in/extra/mysql-systemd-start#L81-L84
  107.             echo 'Initializing certificates'
  108.             mysql_ssl_rsa_setup --datadir="$DATADIR"
  109.             echo 'Certificates initialized'
  110.         fi
  112.         SOCKET="$(_get_config 'socket' "$@")"
  113.         "$@" --skip-networking --socket="${SOCKET}" &
  114.         pid="$!"
  116.         mysql=( mysql --protocol=socket -uroot -hlocalhost --socket="${SOCKET}" )
  118.         for i in {30..0}; do
  119.             if echo 'SELECT 1' | "${mysql[@]}" &> /dev/null; then
  120.                 break
  121.             fi
  122.             echo 'MySQL init process in progress...'
  123.             sleep 1
  124.         done
  125.         if [ "$i" = 0 ]; then
  126.             echo >&2 'MySQL init process failed.'
  127.             exit 1
  128.         fi
  130.         if [ -z "$MYSQL_INITDB_SKIP_TZINFO" ]; then
  131.             # sed is for https://bugs.mysql.com/bug.php?id=20545
  132.             mysql_tzinfo_to_sql /usr/share/zoneinfo | sed 's/Local time zone must be set--see zic manual page/FCTY/' | "${mysql[@]}" mysql
  133.         fi
  135.         if [ ! -z "$MYSQL_RANDOM_ROOT_PASSWORD" ]; then
  136.             export MYSQL_ROOT_PASSWORD="$(pwgen -1 32)"
  137.             echo "GENERATED ROOT PASSWORD: $MYSQL_ROOT_PASSWORD"
  138.         fi
  140.         rootCreate=
  141.         # default root to listen for connections from anywhere
  142.         file_env 'MYSQL_ROOT_HOST' '%'
  143.         if [ ! -z "$MYSQL_ROOT_HOST" -a "$MYSQL_ROOT_HOST" != 'localhost' ]; then
  144.             # no, we don't care if read finds a terminating character in this heredoc
  145.             # https://unix.stackexchange.com/questions/265149/why-is-set-o-errexit-breaking-this-read-heredoc-expression/265151#265151
  146.             read -r -d '' rootCreate <<-EOSQL || true
  147.                 CREATE USER 'root'@'${MYSQL_ROOT_HOST}' IDENTIFIED BY '${MYSQL_ROOT_PASSWORD}' ;
  148.                 GRANT ALL ON *.* TO 'root'@'${MYSQL_ROOT_HOST}' WITH GRANT OPTION ;
  149.             EOSQL
  150.         fi
  152.         "${mysql[@]}" <<-EOSQL
  153.             -- What's done in this file shouldn't be replicated
  154.             --  or products like mysql-fabric won't work
  155.             SET @@SESSION.SQL_LOG_BIN=0;
  157.             ALTER USER 'root'@'localhost' IDENTIFIED BY '${MYSQL_ROOT_PASSWORD}' ;
  158.             GRANT ALL ON *.* TO 'root'@'localhost' WITH GRANT OPTION ;
  159.             ${rootCreate}
  160.             DROP DATABASE IF EXISTS test ;
  161.             FLUSH PRIVILEGES ;
  162.         EOSQL
  164.         if [ ! -z "$MYSQL_ROOT_PASSWORD" ]; then
  165.             mysql+=( -p"${MYSQL_ROOT_PASSWORD}" )
  166.         fi
  168.         file_env 'MYSQL_DATABASE'
  169.         if [ "$MYSQL_DATABASE" ]; then
  170.             echo "CREATE DATABASE IF NOT EXISTS \`$MYSQL_DATABASE\` ;" | "${mysql[@]}"
  171.             mysql+=( "$MYSQL_DATABASE" )
  172.         fi
  174.         file_env 'MYSQL_USER'
  175.         file_env 'MYSQL_PASSWORD'
  176.         if [ "$MYSQL_USER" -a "$MYSQL_PASSWORD" ]; then
  177.             echo "CREATE USER '$MYSQL_USER'@'%' IDENTIFIED BY '$MYSQL_PASSWORD' ;" | "${mysql[@]}"
  179.             if [ "$MYSQL_DATABASE" ]; then
  180.                 echo "GRANT ALL ON \`$MYSQL_DATABASE\`.* TO '$MYSQL_USER'@'%' ;" | "${mysql[@]}"
  181.             fi
  183.             echo 'FLUSH PRIVILEGES ;' | "${mysql[@]}"
  184.         fi
  186.         echo
  187.         ls /docker-entrypoint-initdb.d/ > /dev/null
  188.         for f in /docker-entrypoint-initdb.d/*; do
  189.             process_init_file "$f" "${mysql[@]}"
  190.         done
  192.         if [ ! -z "$MYSQL_ONETIME_PASSWORD" ]; then
  193.             "${mysql[@]}" <<-EOSQL
  194.                 ALTER USER 'root'@'%' PASSWORD EXPIRE;
  195.             EOSQL
  196.         fi
  197.         if ! kill -s TERM "$pid" || ! wait "$pid"; then
  198.             echo >&2 'MySQL init process failed.'
  199.             exit 1
  200.         fi
  202.         echo
  203.         echo 'MySQL init process done. Ready for start up.'
  204.         echo
  205.     fi
  206. fi
  208. exec "$@"

redis

  1. FROM debian:stretch-slim
  3. # add our user and group first to make sure their IDs get assigned consistently, regardless of whatever dependencies get added
  4. RUN groupadd -r redis && useradd -r -g redis redis
  6. # grab gosu for easy step-down from root
  7. # https://github.com/tianon/gosu/releases
  8. ENV GOSU_VERSION 1.10
  9. RUN set -ex; \
  10.     \
  11.     fetchDeps=" \
  12.         ca-certificates \
  13.         dirmngr \
  14.         gnupg \
  15.         wget \
  16.     "; \
  17.     apt-get update; \
  18.     apt-get install -y --no-install-recommends $fetchDeps; \
  19.     rm -rf /var/lib/apt/lists/*; \
  20.     \
  21.     dpkgArch="$(dpkg --print-architecture | awk -F- '{ print $NF }')"; \
  22.     wget -O /usr/local/bin/gosu "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$dpkgArch"; \
  23.     wget -O /usr/local/bin/gosu.asc "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$dpkgArch.asc"; \
  24.     export GNUPGHOME="$(mktemp -d)"; \
  25.     gpg --batch --keyserver ha.pool.sks-keyservers.net --recv-keys B42F6819007F00F88E364FD4036A9C25BF357DD4; \
  26.     gpg --batch --verify /usr/local/bin/gosu.asc /usr/local/bin/gosu; \
  27.     gpgconf --kill all; \
  28.     rm -r "$GNUPGHOME" /usr/local/bin/gosu.asc; \
  29.     chmod +x /usr/local/bin/gosu; \
  30.     gosu nobody true; \
  31.     \
  32.     apt-get purge -y --auto-remove $fetchDeps
  34. ENV REDIS_VERSION 5.0.4
  35. ENV REDIS_DOWNLOAD_URL http://download.redis.io/releases/redis-5.0.4.tar.gz
  36. ENV REDIS_DOWNLOAD_SHA 3ce9ceff5a23f60913e1573f6dfcd4aa53b42d4a2789e28fa53ec2bd28c987dd
  38. # for redis-sentinel see: http://redis.io/topics/sentinel
  39. RUN set -ex; \
  40.     \
  41.     buildDeps=' \
  42.         ca-certificates \
  43.         wget \
  44.         \
  45.         gcc \
  46.         libc6-dev \
  47.         make \
  48.     '; \
  49.     apt-get update; \
  50.     apt-get install -y $buildDeps --no-install-recommends; \
  51.     rm -rf /var/lib/apt/lists/*; \
  52.     \
  53.     wget -O redis.tar.gz "$REDIS_DOWNLOAD_URL"; \
  54.     echo "$REDIS_DOWNLOAD_SHA *redis.tar.gz" | sha256sum -c -; \
  55.     mkdir -p /usr/src/redis; \
  56.     tar -xzf redis.tar.gz -C /usr/src/redis --strip-components=1; \
  57.     rm redis.tar.gz; \
  58.     \
  59. # disable Redis protected mode [1] as it is unnecessary in context of Docker
  60. # (ports are not automatically exposed when running inside Docker, but rather explicitly by specifying -p / -P)
  61. # [1]: https://github.com/antirez/redis/commit/edd4d555df57dc84265fdfb4ef59a4678832f6da
  62.     grep -q '^#define CONFIG_DEFAULT_PROTECTED_MODE 1$' /usr/src/redis/src/server.h; \
  63.     sed -ri 's!^(#define CONFIG_DEFAULT_PROTECTED_MODE) 1$!\1 0!' /usr/src/redis/src/server.h; \
  64.     grep -q '^#define CONFIG_DEFAULT_PROTECTED_MODE 0$' /usr/src/redis/src/server.h; \
  65. # for future reference, we modify this directly in the source instead of just supplying a default configuration flag because apparently "if you specify any argument to redis-server, [it assumes] you are going to specify everything"
  66. # see also https://github.com/docker-library/redis/issues/4#issuecomment-50780840
  67. # (more exactly, this makes sure the default behavior of "save on SIGTERM" stays functional by default)
  68.     \
  69.     make -C /usr/src/redis -j "$(nproc)"; \
  70.     make -C /usr/src/redis install; \
  71.     \
  72.     rm -r /usr/src/redis; \
  73.     \
  74.     apt-get purge -y --auto-remove $buildDeps
  76. RUN mkdir /data && chown redis:redis /data
  77. VOLUME /data
  78. WORKDIR /data
  80. COPY docker-entrypoint.sh /usr/local/bin/
  81. ENTRYPOINT ["docker-entrypoint.sh"]
  83. EXPOSE 6379
  84. CMD ["redis-server"]
  1. capsule image runc redis /usr/local/bin/docker-entrypoint.sh redis-server --id=redis -p 6379:6379 -d

将/usr/local/bin/docker-entrypoint.sh中chown的部分删掉，因为capsule不支持多用户，目前只能用root。
修改后的是这样的：

  1. #!/bin/sh
  2. set -e
  4. # first arg is `-f` or `--some-option`
  5. # or first arg is `something.conf`
  6. if [ "${1#-}" != "$1" ] || [ "${1%.conf}" != "$1" ]; then
  7.     set -- redis-server "$@"
  8. fi
  10. exec "$@"

capsule-demo-app

  1. FROM java:8
  2. VOLUME /tmp
  3. ADD capsule-demo-app.jar app.jar
  4. ENTRYPOINT [ "sh", "-c", "java -jar /app.jar"]
  1. capsule image runc capsule-demo-app "java -jar /app.jar" -id capsule-demo-container -e "SPRING_PROFILES_ACTIVE=prod" -p 8080:8080 -d -link mysql:mysql-container -link redis:redis-container