Securing Your MariaDB Root User: Setting a Password in Docker

• Docker: Docker is a platform for creating and running isolated software packages called containers. These containers can bundle an application with all its dependencies.
• MariaDB: MariaDB is a popular open-source relational database management system similar to MySQL.

By default, when you run a MariaDB Docker image, it creates a root user (the most powerful user) with no password. This might seem insecure, but it's because Docker containers are typically designed for development or testing purposes where security is less critical.

However, you can configure Docker to set a password for the root user during startup. There are two ways to achieve this:

Here's a key point to remember:

• If you use a volume to persist MariaDB data (which is recommended for production use), setting the password only affects the first run of the container. Subsequent restarts will use the existing data volume, which already has the configured password (or lack thereof). So, to change the password after the initial setup, you'll need to remove the data volume and let the container re-initialize.

Setting MariaDB Password with Docker

Using docker run with Environment Variable:

docker run -p 3306:3306 --name my-mariadb \
  -e MARIADB_ROOT_PASSWORD=your_strong_password \
  mariadb:latest

Explanation:

• docker run: This command starts a new Docker container.
• -p 3306:3306: This maps the container's port 3306 (MariaDB default) to port 3306 on your host machine, allowing you to connect from there.
• --name my-mariadb: This assigns a name to the container for easier identification.
• -e MARIADB_ROOT_PASSWORD=your_strong_password: This sets the environment variable MARIADB_ROOT_PASSWORD with your chosen password. Remember to replace your_strong_password with a secure password.
• mariadb:latest: This specifies the MariaDB image to use (latest version in this case).

Using docker-compose.yml:

Here's a sample docker-compose.yml file:

version: '3'
services:
  my-mariadb:
    image: mariadb:latest
    environment:
      MYSQL_ROOT_PASSWORD: your_strong_password  # Can also use MARIADB_ROOT_PASSWORD
    volumes:
      - mariadb-data:/var/lib/mysql  # Optional volume to persist data

volumes:
  mariadb-data:  # Optional volume definition

• version: '3': This specifies the docker-compose version.
• services: This section defines the services running in your application.
• my-mariadb: This defines a service named my-mariadb.
• image: mariadb:latest: This specifies the MariaDB image to use.
• environment: This section sets environment variables for the service.
  • MYSQL_ROOT_PASSWORD (or MARIADB_ROOT_PASSWORD): This sets the root user password.
• volumes: This section defines volumes for persistent data (optional).
  • mariadb-data: This defines a volume named mariadb-data.
  • The volume is then mounted to /var/lib/mysql inside the container, allowing data persistence.

• Docker Secrets allow you to store sensitive information like passwords outside the container definition. You can create a secret containing your MariaDB password and then reference it in the container startup command. This improves security by keeping the password out of plain sight.

Here's a basic example using the docker secret create command to create a secret named mariadb-password with your actual password as the value. Then, the docker run command references the secret with the --secret flag.

Note: Consult the official Docker documentation for detailed instructions on creating and using Docker Secrets .

Entrypoint Script:

• You can create a custom script that sets the MariaDB password during container startup. This script would be placed within the container image and executed on launch. The script could interact with the MariaDB initialization process to define the password.

Caution: While this method offers some flexibility, it requires modifying the container image itself and managing the script within the image build process. This can be more complex to maintain compared to environment variables.

Initializing with a Configuration File:

• MariaDB allows configuration through files placed in specific locations within the container. You could potentially create a configuration file containing a SET PASSWORD statement for the root user. This file would then be mounted into the container during startup, instructing MariaDB to set the password based on the configuration.

Similar to the entrypoint script, this method involves modifying the container image and managing additional configuration files. It's generally less preferred compared to environment variables or secrets.

Choosing the Right Method:

• For most cases, using environment variables or docker-compose for password configuration is the simplest and most secure approach.
• If you have stricter security requirements, Docker Secrets offer an extra layer of protection.
• The other methods (entrypoint script and configuration file) are less common and should only be considered for specific scenarios where environment variables or secrets are not feasible.