Mariadb-docker: How to recover root password?

[paulz1]

I have some owncloud dokcer container that use mariadb database.
In turn, mariadb is also a docker container.

While the application works pretty well, I find recently that I don't know the root password for mariadb database.
At the moment of creation, the passwrods for mysql_root and onwcloud user were cretaed randomly, like :
--env "MYSQL_ROOT_PASSWORD=$(shell pwgen --secure 40 1)"

Unfortunately, at this moment I noted only password for owncloud user.
So, actually owncloud application works well and I could connect as owncloud user to owncloud-production database.
But I don't know the root password and I could not connect to mariadb as root.

Another problem, that I could not use a standard procedure to reset root password. In the mariadb container the process mysqld are running with PID 1, so I could not stop or kill it.

Is there some solution for this situation?

Thank you for the help.

[paulz1]

Just some additonal information.

I tired as well

mysql -u debian-sys-maint -p
Enter password:

We could find password for debian-sys-maint in /etc/mysql files. But it does not work.

[visago]

Try

docker exec mysql-docker-container env

You should see your root password in the environmental variable MYSQL_ROOT_PASSWORD

[paulz1]

No, unfortunately it does not work.
Each time when I launch my application, mariadb container is removed and recreated. So env variables are reset using the same --env "MYSQL_ROOT_PASSWORD=$(shell pwgen --secure 40 1)"
But as I use the persistent storage, this reset is ignored confirm to mariadb documentation :

If you start your mariadb container instance with a data directory that already contains a database (specifically, a mysql subdirectory), the $MYSQL_ROOT_PASSWORD variable should be omitted from the run command line; it will in any case be ignored, and the pre-existing database will not be changed in any way.

So env variables are set, but they are wrong and the real password are different.

[paulz1]

It seems that this problem is very particular case of my application (owncloud).
But for me it is more general.

If one day somebody launch a mariadb docker over an existing permanent storage with existing database and he do not know the root password of this database... This person should have a possibility to reset the root password.
Am I right?

[jrmoserbaltimore]

Bring up MariaDB container with a command line to ignore all grants, then connect to the database and update root's password.

[paulz1]

Thanks, bluefoxicy

At first I thought I understand you idea. But just to be sure, how should I do this step :

Bring up MariaDB container with a command line to ignore all grants

I could connect to mariadb container (docker exec -ti mariadb bash), but then I need stop mysqld process before relaunch it in safe-mode without grants. But it's impossible because mysqld process turn with PID 1, so if I kill it my container stops.
May be I misunderstood something?

[yosifkit]

It looks like it is a flag to mysqld: --skip-grant-tables. So on a docker run it would be like this:

$ docker run -d -e [...] -v [...] mariadb:10 --skip-grant-tables

Then you should be able to connect as root without a password and set the password to a new value.

[paulz1]

Thank you very much.
It did perfectly the trick. I could reset the root password.

I will close the issue now.
But, by the way, it could be a feature (not a bug ;-)), for the peoples who care about password accessible by env variables of docker.
Once we launch mariadb for first time and created the database on some persistent storage, we could set env variable to some fake password, or just change the password using "--skip-grants-table".