Mariadb-docker: find: '/var/lib/mysql/mysql': Permission denied

[citiscaner]

I have configured 2 K8s yaml file for MariaDB

First yaml is used for the initial setup of the DB (with persistent volume being empty that is mounted to /var/lib/mysql), a 2nd persistent volume is mounted to /docker-entrypoint-initdb.d which contains the mysqldump backup to be restored upon MariaDB pod creation. This yaml contains the variable MYSQL_RANDOM_ROOT_PASSWORD and has set securityContext fsGroup:999 and this works fine.

The second yaml file is set as a deployment where it expect the persistent volume mounted into /var/lib/mysql. The env variable for MYSQL_RANDOM_ROOT_PASSWORD and MYSQL_ROOT_PASSWORD are NOT set on this yaml file. This yaml file also contains the securityContext below:

  securityContext:
    fsGroup: 999

But when I deploy the second yaml file, I am getting an error and the log shows:
find: '/var/lib/mysql/mysql': Permission denied

Note: The persistent volume is an NFS mount where root is mapped to the NAS admin user.

Any idea?

[wglambert]

Ensure you're mounting the NFS volume correctly https://stackoverflow.com/a/46481637/9959005

Since this issue doesn't imply an error with the image it would be better asked over at the Docker Community Forums, the Docker Community Slack, Stack Overflow, or a kubernetes forum. As these repositories are for issues with the image and not necessarily for questions of usability

[yosifkit]

It sounds like it is trying to ensure that the files are all readable by the mysql user:

https://github.com/docker-library/mariadb/blob/4ffbde76c75a49456d1729bb142d1c0c9c51f574/10.3/docker-entrypoint.sh#L70

You can skip this functionality by starting the container as a non-root user as long as it can access the data directory (all the default config files and folders are world readable).

[citiscaner]

It sounds like it is trying to ensure that the files are all readable by the mysql user:

mariadb/10.3/docker-entrypoint.sh

Line 70 in 4ffbde7

find "$DATADIR" ! -user mysql -exec chown mysql '{}' +
You can skip this functionality by starting the container as a non-root user as long as it can access the data directory (all the default config files and folders are world readable).

This works! I set the following in my K8s yaml deployment file
securityContext:
runAsUser: 999
fsGroup: 999