nullata/mariadb-galera Docker 镜像 - 轩辕镜像 | Docker 镜像高效稳定拉取服务

Nullata MariaDB Galera镜像

什么是MariaDB Galera？

MariaDB Galera是一个多主数据库集群解决方案，支持同步复制和高可用性。Nullata MariaDB Galera镜像提供LDAP、SSL/TLS功能支持及多种操作模式，旨在为各类部署环境提供最大灵活性。

MariaDB Galera概述
商标说明：本软件列表由Nullata打包。产品中提及的相关商标归各自公司所有，使用这些商标并不意味着任何关联或背书。

快速启动

console
docker run --name mariadb \
  -e ALLOW_EMPTY_PASSWORD=yes \
  nullata/mariadb-galera:latest

⚠️ 警告 ⚠️：快速设置仅适用于开发环境。建议修改不安全的默认凭据，并查看配置部分的可用配置选项以实现更安全的部署。

✨ 生产环境部署请参考GitHub仓库中各版本对应的Docker Compose示例配置，包括多节点配置和不同版本的推荐环境设置。

获取镜像

获取Nullata MariaDB Galera Docker镜像的推荐方式是从Docker Hub Registry拉取预构建镜像。

console
docker pull nullata/mariadb-galera:latest

如需使用特定版本，可拉取带版本标签的镜像。可在Docker Hub Registry中查看可用版本列表。

console
docker pull nullata/mariadb-galera:[TAG]

数据持久化

如果删除容器，所有数据将丢失，下次运行镜像时数据库将重新初始化。为避免数据丢失，应挂载一个在容器删除后仍能保留的卷。

持久化需挂载目录到/nullata/mariadb路径。如果挂载的目录为空，首次运行时将自动初始化。

console
docker run \
    -e ALLOW_EMPTY_PASSWORD=yes \
    -v /path/to/mariadb-persistence:/nullata/mariadb \
    nullata/mariadb-galera:latest

或修改本仓库各版本目录中的docker-compose.yml文件：

yaml
services:
  mariadb:
  ...
    volumes:
      - /path/to/mariadb-persistence:/nullata/mariadb
  ...

连接到其他容器

使用Docker容器网络，容器内运行的MariaDB服务器可轻松被应用容器访问。同一网络中的容器可使用容器名称作为主机名进行通信。

使用命令行

本示例将创建一个MariaDB客户端实例，连接到与客户端在同一Docker网络上运行的服务器实例。

步骤1：创建网络

console
docker network create app --driver bridge

步骤2：启动MariaDB服务器实例

使用--network app参数将MariaDB容器附加到app网络。

console
docker run -d --name mariadb-galera \
    -e ALLOW_EMPTY_PASSWORD=yes \
    --network app \
    nullata/mariadb-galera:latest

步骤3：启动MariaDB客户端实例

最后创建新容器实例以启动MariaDB客户端并连接到上一步创建的服务器：

console
docker run -it --rm \
    --network app \
    nullata/mariadb-galera:latest mysql -h mariadb-galera -u root

使用Docker Compose文件

未指定时，Docker Compose会自动创建新网络并将所有部署的服务附加到该网络。以下示例显式定义名为database的新bridge网络，假设您希望从自定义应用镜像（服务名称为myapp）连接到MariaDB服务器。

yaml
version: '2'

networks:
  app:
    driver: bridge
  database:
    driver: bridge

services:
  mariadb-galera:
    image: nullata/mariadb-galera:latest
    environment:
      - ALLOW_EMPTY_PASSWORD=yes
    networks:
      - database

  myapp:
    image: YOUR_APPLICATION_IMAGE
    networks:
      - app
      - database

使用以下命令启动容器：

console
docker compose up -d

其他docker-compose示例（单节点、全网格集群、主从拓扑）

yaml
services:
    ############################################
    # 单节点测试
    ############################################
    mariadb-single:
        profiles: ["test-single"]
        image: nullata/mariadb-galera:latest
        ports:
            - "***:3306" # 示例测试外部端口
        volumes:
            - "/opt/services/database/nullata-galera-test:/nullata/mariadb"
        environment:
            - MARIADB_GALERA_CLUSTER_ADDRESS=gcomm://
            - MARIADB_GALERA_CLUSTER_BOOTSTRAP=yes
            - MARIADB_GALERA_CLUSTER_NAME=test-single
            - MARIADB_GALERA_MARIABACKUP_USER=backup
            - MARIADB_GALERA_MARIABACKUP_PASSWORD=testpass
            - MARIADB_USER=testuser
            - MARIADB_PASSWORD=testpass
            - MARIADB_ROOT_PASSWORD=testroot
            - MARIADB_DATABASE=testdb
        healthcheck:
            test: ["CMD", "/opt/nullata/scripts/mariadb-galera/healthcheck.sh"]
            interval: 15s
            timeout: 5s
            retries: 6

    ############################################
    # 显式全网格集群
    ############################################
    mariadb-node1:
        profiles: ["test-cluster"]
        image: nullata/mariadb-galera:latest
        ports:
            - "***:3306" # 示例测试外部端口
        volumes:
            - "/opt/services/database/nullata-galera-test-node1:/nullata/mariadb"
            - "/opt/services/database/backup/nullata-galera-test:/backup"
        environment:
            - MARIADB_GALERA_CLUSTER_ADDRESS=gcomm://mariadb-node1,mariadb-node2,mariadb-node3
            - MARIADB_GALERA_CLUSTER_BOOTSTRAP=yes
            - MARIADB_GALERA_CLUSTER_NAME=test-cluster
            - MARIADB_GALERA_MARIABACKUP_USER=backup
            - MARIADB_GALERA_MARIABACKUP_PASSWORD=testpass
            - MARIADB_ROOT_PASSWORD=testroot
            # 完全 outage 后强制重新引导：
            - MARIADB_GALERA_FORCE_SAFETOBOOTSTRAP=yes
        healthcheck:
            test: ["CMD", "/opt/nullata/scripts/mariadb-galera/healthcheck.sh"]

    mariadb-node2:
        profiles: ["test-cluster"]
        image: nullata/mariadb-galera:latest
        ports:
            - "***:3306" # 示例测试外部端口
        volumes:
            - "/opt/services/database/nullata-galera-test-node2:/nullata/mariadb"
        environment:
            - MARIADB_GALERA_CLUSTER_ADDRESS=gcomm://mariadb-node1,mariadb-node2,mariadb-node3
            - MARIADB_GALERA_CLUSTER_NAME=test-cluster
            - MARIADB_GALERA_MARIABACKUP_USER=backup
            - MARIADB_GALERA_MARIABACKUP_PASSWORD=testpass
            - MARIADB_ROOT_PASSWORD=testroot
        depends_on:
            mariadb-node1:
                condition: service_healthy
        healthcheck:
            test: ["CMD", "/opt/nullata/scripts/mariadb-galera/healthcheck.sh"]

    mariadb-node3:
        profiles: ["test-cluster"]
        image: nullata/mariadb-galera:latest
        ports:
            - "***:3306" # 示例测试外部端口
        volumes:
            - "/opt/services/database/nullata-galera-test-node3:/nullata/mariadb"
        environment:
            - MARIADB_GALERA_CLUSTER_ADDRESS=gcomm://mariadb-node1,mariadb-node2,mariadb-node3
            - MARIADB_GALERA_CLUSTER_NAME=test-cluster
            - MARIADB_GALERA_MARIABACKUP_USER=backup
            - MARIADB_GALERA_MARIABACKUP_PASSWORD=testpass
            - MARIADB_ROOT_PASSWORD=testroot
        depends_on:
            mariadb-node1:
                condition: service_healthy
        healthcheck:
            test: ["CMD", "/opt/nullata/scripts/mariadb-galera/healthcheck.sh"]

    ############################################
    # 主从（星形拓扑）
    ############################################
    mariadb-seed:
        profiles: ["test-seed"]
        image: nullata/mariadb-galera:latest
        ports:
          - "***:3306" # 示例测试外部端口
        volumes:
            - "/opt/services/database/nullata-galera-test-seed0:/nullata/mariadb"
            - "/opt/services/database/backup/nullata-galera-test:/backup"
        environment:
            - MARIADB_GALERA_CLUSTER_ADDRESS=gcomm://
            - MARIADB_GALERA_CLUSTER_BOOTSTRAP=yes
            - MARIADB_GALERA_CLUSTER_NAME=test-seed
            - MARIADB_GALERA_MARIABACKUP_USER=backup
            - MARIADB_GALERA_MARIABACKUP_PASSWORD=testpass
            - MARIADB_ROOT_PASSWORD=testroot
            # 完全 outage 后强制重新引导：
            - MARIADB_GALERA_FORCE_SAFETOBOOTSTRAP=yes
        healthcheck:
            test: ["CMD", "/opt/nullata/scripts/mariadb-galera/healthcheck.sh"]

    mariadb-join1:
        profiles: ["test-seed"]
        image: nullata/mariadb-galera:latest
        ports:
            - "***:3306" # 示例测试外部端口
        volumes:
            - "/opt/services/database/nullata-galera-test-join1:/nullata/mariadb"
        environment:
            - MARIADB_GALERA_CLUSTER_ADDRESS=gcomm://mariadb-seed
            - MARIADB_GALERA_CLUSTER_NAME=test-seed
            - MARIADB_GALERA_MARIABACKUP_USER=backup
            - MARIADB_GALERA_MARIABACKUP_PASSWORD=testpass
            - MARIADB_ROOT_PASSWORD=testroot
        depends_on:
            mariadb-seed:
                condition: service_healthy
        healthcheck:
            test: ["CMD", "/opt/nullata/scripts/mariadb-galera/healthcheck.sh"]

使用以下命令运行指定配置文件：

console
docker compose --profile <profile> up -d 

配置

有关其他配置详情、环境变量、docker-compose及自行构建说明，请访问： github.com/nullata/containers

🆕 (2025年11月) 新增强化实验镜像 🆕

⚠️ LATEST标签不基于HARDENED-EXPERIMENTAL ⚠️

❗2026年3月起，强化镜像将作为标准附加镜像提供，实验阶段将逐步结束。

HARDENED-EXPERIMENTAL镜像增加了额外的安全考虑和更小的镜像尺寸，旨在减少总体***面。以下是新增改进列表：

• 基于debian:bookworm-slim
• 安装后移除文档和man页面
• 专用用户账户
• 非登录shell
• 剥离静态库
• 移除测试目录
• 移除包管理器
• 限制性目录权限
• 根用户拥有的二进制文件
• 限制性umask
• 移除组写权限
• 剥离所有setuid/setgid位
• 移除全局可写目录
• 标准化可执行权限
• 临时目录设置粘滞位
• 清除缓存目录
• 构建元数据标签
• 增强OCI标签
• 带pipefail的shell
• 内置健康检查
• 启动期宽限时间
• 禁止权限提升
• 最小化能力集（cap_drop: ALL，仅保留CHOWN、DAC_OVERRIDE、SETGID、SETUID、NET_BIND_SERVICE）
• 安全tmpfs挂载
• 通过tmpfs限制防止可执行注入
• CPU和内存限制

强化镜像使用示例

yaml
 services:
    ############################################
    # 单节点测试
    ############################################
    mariadb-single:
        profiles: ["test-single"]
        image: nullata/mariadb-galera:12.1.2-hardened-experimental

        security_opt:
            - no-new-privileges:true

        cap_drop:
            - ALL
        cap_add:
            - CHOWN
            - DAC_OVERRIDE
            - SETGID
            - SETUID
            - NET_BIND_SERVICE

        ports:
            - "***:3306" # 示例测试外部端口

        volumes:
            - "/opt/services/database/nullata-galera-test:/nullata/mariadb"

        # 带安全限制的临时文件系统
        tmpfs:
            - /tmp:nosuid,nodev,size=1g,mode=1777
            - /var/tmp:nosuid,nodev,size=500m,mode=1777

        environment:
            - MARIADB_GALERA_CLUSTER_ADDRESS=gcomm://
            - MARIADB_GALERA_CLUSTER_BOOTSTRAP=yes
            - MARIADB_GALERA_CLUSTER_NAME=test-single
            - MARIADB_GALERA_MARIABACKUP_USER=backup
            - MARIADB_GALERA_MARIABACKUP_PASSWORD=testpass
            - MARIADB_USER=testuser
            - MARIADB_PASSWORD=testpass
            - MARIADB_ROOT_PASSWORD=testroot
            - MARIADB_DATABASE=testdb

        healthcheck:
            test: ["CMD", "/opt/nullata/scripts/mariadb-galera/healthcheck.sh"]
            interval: 15s
            timeout: 5s
            retries: 6
            start_period: 60s

        # 资源限制
        deploy:
            resources:
                limits:
                    cpus: '2'
                    memory: 4G
                reservations:
                    cpus: '1'
                    memory: 2G

    ############################################
    # 显式全网格集群
    ############################################
    mariadb-node1:
        profiles: ["test-cluster"]
        image: nullata/mariadb-galera:12.1.2-hardened-experimental

        security_opt:
            - no-new-privileges:true

        cap_drop:
            - ALL
        cap_add:
            - CHOWN
            - DAC_OVERRIDE
            - SETGID
            - SETUID
            - NET_BIND_SERVICE

        ports:
            - "***:3306" # 示例测试外部端口

        volumes:
            - "/opt/services/database/nullata-galera-test-node1:/nullata/mariadb"
            - "/opt/services/database/backup/nullata-galera-test:/backup"

        tmpfs:
            - /tmp:nosuid,nodev,size=1g,mode=1777
            - /var/tmp:nosuid,nodev,size=500m,mode=1777

        environment:
            - MARIADB_GALERA_CLUSTER_ADDRESS=gcomm://mariadb-node1,mariadb-node2,mariadb-node3
            - MARIADB_GALERA_CLUSTER_BOOTSTRAP=yes
            - MARIADB_GALERA_CLUSTER_NAME=test-cluster
            - MARIADB_GALERA_MARIABACKUP_USER=backup
            - MARIADB_GALERA_MARIABACKUP_PASSWORD=testpass
            - MARIADB_ROOT_PASSWORD=testroot
            - MARIADB_GALERA_FORCE_SAFETOBOOTSTRAP=yes

        healthcheck:
            test: ["CMD", "/opt/nullata/scripts/mariadb-galera/healthcheck.sh"]
            interval: 15s
            timeout: 5s
            retries: 6
            start_period: 60s

        deploy:
            resources:
                limits:
                    cpus: '2'
                    memory: 4G
                reservations:
                    cpus: '1'
                    memory: 2G

    mariadb-node2:
        profiles: ["test-cluster"]
        image: nullata/mariadb-galera:12.1.2-hardened-experimental

        security_opt:
            - no-new-privileges:true

        cap_drop:
            - ALL
        cap_add:
            - CHOWN
            - DAC_OVERRIDE