From a85fad69600216e9c547da28ce35de05b7d78bee Mon Sep 17 00:00:00 2001 From: Jeff Turner Date: Mon, 6 Jul 2026 18:01:14 +1000 Subject: [PATCH] fix(mariadb,mysql plugin): ignore /etc/mysql config files, for better isolation (#2904) By default, mariadbd reads /etc/mysql/mariadb.cnf, and if the system has another version of MariaDB installed, those config files can cause the Devbox mariadbd to fail (e.g. requesting loading plugins not available). This commit causes devbox mariadbd (and mysqld) to only read from $MYSQL_CONF (typically devbox.d/mariadb/my.cnf). Additionally, wrap the client/admin binaries (mariadb, mariadb-admin, mariadb-dump, mysqldump, mysql, mysqladmin) with --defaults-file and --socket so they also ignore /etc/mysql and connect to the correct socket. Fixes #2904 --- plugins/mariadb/flake.nix | 25 ++++++++++++++----------- plugins/mariadb/my.cnf | 19 +++++++++++++++---- plugins/mysql/flake.nix | 13 +++++++++++-- plugins/mysql/my.cnf | 19 ++++++++++++++++--- 4 files changed, 56 insertions(+), 20 deletions(-) diff --git a/plugins/mariadb/flake.nix b/plugins/mariadb/flake.nix index 1ac539e6357..c2c2f09a7ef 100644 --- a/plugins/mariadb/flake.nix +++ b/plugins/mariadb/flake.nix @@ -14,27 +14,30 @@ nativeBuildInputs = [ nixpkgs.legacyPackages.{{.System}}.makeWrapper]; postBuild = '' - wrapProgram $out/bin/mysqld \ - --add-flags '--basedir=$out --datadir=''$MYSQL_DATADIR --pid-file=''$MYSQL_PID_FILE --socket=''$MYSQL_UNIX_PORT'; - wrapProgram $out/bin/mariadbd \ - --add-flags '--basedir=$out --datadir=''$MYSQL_DATADIR --pid-file=''$MYSQL_PID_FILE --socket=''$MYSQL_UNIX_PORT'; - - wrapProgram $out/bin/mysqld_safe \ - --add-flags '--basedir=$out --datadir=''$MYSQL_DATADIR --pid-file=''$MYSQL_PID_FILE --socket=''$MYSQL_UNIX_PORT'; + --add-flags '--defaults-file=''$MYSQL_CONF --basedir=$out --datadir=''$MYSQL_DATADIR --pid-file=''$MYSQL_PID_FILE --socket=''$MYSQL_UNIX_PORT'; if [-f $out/bin/mariadbd-safe]; then wrapProgram $out/bin/mariadbd_safe \ - --add-flags '--basedir=$out --datadir=''$MYSQL_DATADIR --pid-file=''$MYSQL_PID_FILE --socket=''$MYSQL_UNIX_PORT'; + --add-flags '--defaults-file=''$MYSQL_CONF --basedir=$out --datadir=''$MYSQL_DATADIR --pid-file=''$MYSQL_PID_FILE --socket=''$MYSQL_UNIX_PORT'; fi - wrapProgram "$out/bin/mysql_install_db" \ - --add-flags '--basedir=$out --datadir=''$MYSQL_DATADIR --pid-file=''$MYSQL_PID_FILE --basedir=''$MYSQL_BASEDIR'; - if [-f $out/bin/mariadb-install-db]; then wrapProgram "$out/bin/mariadb_install_db" \ --add-flags '--basedir=$out --datadir=''$MYSQL_DATADIR --pid-file=''$MYSQL_PID_FILE --basedir=''$MYSQL_BASEDIR'; fi + + wrapProgram $out/bin/mariadb-admin \ + --add-flags '--defaults-file=''$MYSQL_CONF --socket=''$MYSQL_UNIX_PORT'; + + wrapProgram $out/bin/mariadb \ + --add-flags '--defaults-file=''$MYSQL_CONF --socket=''$MYSQL_UNIX_PORT'; + + wrapProgram $out/bin/mariadb-dump \ + --add-flags '--defaults-file=''$MYSQL_CONF --socket=''$MYSQL_UNIX_PORT'; + + # Don't wrap 'mysql' or any mysql binaries, as they are correctly left as symlinks + ''; }; in{ diff --git a/plugins/mariadb/my.cnf b/plugins/mariadb/my.cnf index fbe15dd80be..83716567cdf 100644 --- a/plugins/mariadb/my.cnf +++ b/plugins/mariadb/my.cnf @@ -1,6 +1,17 @@ -# MySQL configuration file +# MySQL configuration file for Devbox MariaDB +# +# This file is read via --defaults-file, which means ONLY this config file +# is read (system configs in /etc/ are skipped). +# +# Runtime paths (datadir, socket, pid-file, basedir) are set by the wrapper +# script via environment variables and cannot be overridden here: +# +# MYSQL_DATADIR = --datadir (default: .devbox/virtenv/mariadb/data) +# MYSQL_UNIX_PORT = --socket (default: .devbox/virtenv/mariadb/run/mysql.sock) +# MYSQL_PID_FILE = --pid-file (default: .devbox/virtenv/mariadb/run/mysql.pid) [mariadbd] -# Change this port if 3306 is already used -#port = 3306 -log_error=mysql.log + +# The TCP/IP port the server listens on. +# Change this if 3306 is already in use. +# port = 3306 diff --git a/plugins/mysql/flake.nix b/plugins/mysql/flake.nix index 74787d4497e..333e77bcb7a 100644 --- a/plugins/mysql/flake.nix +++ b/plugins/mysql/flake.nix @@ -15,10 +15,19 @@ postBuild = '' wrapProgram $out/bin/mysqld \ - --add-flags '--basedir=''$MYSQL_BASEDIR --datadir=''$MYSQL_DATADIR --pid-file=''$MYSQL_PID_FILE --socket=''$MYSQL_UNIX_PORT'; + --add-flags '--defaults-file=''$MYSQL_CONF --basedir=''$MYSQL_BASEDIR --datadir=''$MYSQL_DATADIR --pid-file=''$MYSQL_PID_FILE --socket=''$MYSQL_UNIX_PORT'; wrapProgram $out/bin/mysqld_safe \ - --add-flags '--basedir=''$MYSQL_BASEDIR --datadir=''$MYSQL_DATADIR --pid-file=''$MYSQL_PID_FILE --socket=''$MYSQL_UNIX_PORT'; + --add-flags '--defaults-file=''$MYSQL_CONF --basedir=''$MYSQL_BASEDIR --datadir=''$MYSQL_DATADIR --pid-file=''$MYSQL_PID_FILE --socket=''$MYSQL_UNIX_PORT'; + + wrapProgram $out/bin/mysqladmin \ + --add-flags '--defaults-file=''$MYSQL_CONF --socket=''$MYSQL_UNIX_PORT'; + + wrapProgram $out/bin/mysql \ + --add-flags '--defaults-file=''$MYSQL_CONF --socket=''$MYSQL_UNIX_PORT'; + + wrapProgram $out/bin/mysqldump \ + --add-flags '--defaults-file=''$MYSQL_CONF --socket=''$MYSQL_UNIX_PORT'; ''; }; in{ diff --git a/plugins/mysql/my.cnf b/plugins/mysql/my.cnf index a749c470084..43bbd19478e 100644 --- a/plugins/mysql/my.cnf +++ b/plugins/mysql/my.cnf @@ -1,6 +1,19 @@ -# MySQL configuration file +# MySQL configuration file for Devbox MySQL +# +# This file is read via --defaults-file, which means ONLY this config file +# is read (system configs in /etc/ are skipped). +# +# Runtime paths (datadir, socket, pid-file, basedir) are set by the wrapper +# script via environment variables and cannot be overridden here: +# +# MYSQL_DATADIR = --datadir (default: .devbox/virtenv/mysql/data) +# MYSQL_UNIX_PORT = --socket (default: .devbox/virtenv/mysql/run/mysql.sock) +# MYSQL_PID_FILE = --pid-file (default: .devbox/virtenv/mysql/run/mysql.pid) -# [mysqld] +[mysqld] +# Uncomment to disable binary logging. # skip-log-bin -# Change this port if 3306 is already used +# +# The TCP/IP port the server listens on. +# Change this if 3306 is already in use. #port = 3306