OpenShift中MariaDB权限问题求助：无法创建ddl_recovery.log文件

问题背景 #

在OpenShift部署应用时，MariaDB容器启动失败，出现权限拒绝错误，不清楚如何在Pod配置中添加initContainer修复该问题。

错误日志 #

2022-11-18 02:22:42+00:00 [Note] [Entrypoint]: Entrypoint script for MariaDB Server 1:10.9.4+maria~ubu2204 started.
2022-11-18 02:22:42+00:00 [Note] [Entrypoint]: Initializing database files
2022-11-18  2:22:42 0 [Warning] Can't create test file /var/lib/mysql/backend.lower-test
2022-11-18  2:22:42 0 [ERROR] mariadbd: Can't create/write to file './ddl_recovery.log' (Errcode: 13 "Permission denied")
2022-11-18  2:22:42 0 [ERROR] DDL_LOG: Failed to create ddl log file: ./ddl_recovery.log
2022-11-18  2:22:42 0 [ERROR] Aborting

原OpenShift部署脚本 #

apiVersion: v1
items:
- apiVersion: v1
  kind: Pod
  metadata:
    labels:
      app: application
      name: backend
    name: backend
  spec:
    containers:
    - env:
      image: db_image
      name: backend
      ports:
      - containerPort: 3306
        name: backend
      volumeMounts:
      - mountPath: /var/lib/root
        name: backend-volume
    volumes:
    - name: backend-volume
      persistentVolumeClaim:
        claimName: backend-claim
- apiVersion: v1
  kind: Pod
  metadata:
    labels:
      app: application
      name: flask
    name: flask
  spec:
    containers:
    - env:
      - name: IP_ADDR
        value: ${mariadb_ip_addr}
      image: flask_image
      name: flask
      ports:
      - containerPort: 5000
        name: flask
      resources:
        limits:
          cpu: "0.5"
- apiVersion: v1
  kind: Service
  metadata:
    labels:
      app: application
      name: flask
    name: flask
  spec:
    ports:
    - port: 5000
    selector: 
      name: flask
- apiVersion: v1
  kind: Service
  metadata:
    labels: 
      app: application
      name: backend
    name: backend
  spec:
    ports:
    - port: 3306
    selector:
      name: backend
- apiVersion: v1
  kind: PersistentVolumeClaim
  metadata: 
    labels: 
      app: application
    name: backend-claim
  spec:
    accessModes:
    - ReadWriteOnce
    resources:
      requests:
        storage: 10Mi
kind: List
metadata: {}

Dockerfile #

FROM mariadb
LABEL description = "This is my mariadb dockerfile"
EXPOSE 3306
ENV MARIADB_ROOT_PASSWORD=Password123!
ENV MARIADB_DATABASE demo
USER root
COPY ./sql-scripts/ /docker-entrypoint-initdb.d/ 

修复方案 #

1. 修正挂载路径 #

原Pod配置中MariaDB容器的volumeMounts挂载路径为/var/lib/root，这是错误的，MariaDB默认数据目录为/var/lib/mysql，需修改挂载路径。

2. 添加initContainer配置 #

在backend Pod的spec下新增initContainers字段，用于调整持久化卷的权限，确保MariaDB进程可读写该目录。修改后的backend Pod配置如下：

- apiVersion: v1
  kind: Pod
  metadata:
    labels:
      app: application
      name: backend
    name: backend
  spec:
    # 添加initContainer调整目录权限
    initContainers:
    - name: fix-permissions
      image: busybox:1.36
      command: ["sh", "-c", "chown -R 1001:1001 /var/lib/mysql"]
      volumeMounts:
      - name: backend-volume
        mountPath: /var/lib/mysql
    containers:
    - env:
      - name: MARIADB_ROOT_PASSWORD
        value: Password123!
      - name: MARIADB_DATABASE
        value: demo
      image: db_image
      name: backend
      ports:
      - containerPort: 3306
        name: backend
      volumeMounts:
      # 修正挂载路径为MariaDB数据目录
      - mountPath: /var/lib/mysql
        name: backend-volume
    volumes:
    - name: backend-volume
      persistentVolumeClaim:
        claimName: backend-claim

关键说明 #

• initContainer使用busybox镜像执行权限调整命令，官方MariaDB镜像默认使用UID为1001的用户运行，即使Dockerfile中设置USER root，启动脚本仍可能切换回非root用户。
• 确保initContainer与主容器挂载同一个持久化卷，且挂载路径完全一致。
• 建议将环境变量移至Pod配置中，避免硬编码在Dockerfile，提升配置灵活性。

内容的提问来源于stack exchange，提问作者Rajesh Patel