Issue: TLS Enforcement by MariaDB Client in Linux Alpine Base Image

[rayblair06]

Hey,

I've encountered an issue when mixing Linux Alpine as a base image with MySQL database instances. By default, the MariaDB client is used, which enforces TLS for database connections (see reference [1]). This creates a challenge when running commands with the mysql client (alias mariadb), particularly for tasks like importing squashed migrations.

This issue seems to crop up when mixing MariaDB client with a MySQL database instance. While one proposed solution might be switching over to a MariaDB database instance, the reality is that mixing these two technologies isn’t uncommon. Plus, Linux Alpine is a popular choice for Docker base images, so this situation is likely to affect quite a few users.

Problem Details:

1. Default TLS Enforcement: The MariaDB client enforces TLS, which conflicts with certain operations that rely on non-TLS connections.
2. Impact on Laravel Framework: In the Laravel framework, the MySqlSchemaState class (reference [2]) leverages the mysql client for some operations. This default TLS enforcement results in errors with no apparent way to override it.

Proposed Solutions:

1. Add a mechanism to explicitly disable TLS enforcement when using the MariaDB client in such scenarios.
2. Provide configuration options or workarounds for Laravel's MySqlSchemaState to handle this gracefully.

Environment:

• Base Image: Linux Alpine
• Database Client: MariaDB (default in Alpine)
• Database: MySQL
• Laravel Framework: 11.x

Reproduced Repo:

https://github.com/rayblair06/laravel-mariadb-11-4-bug

References:

1. MariaDB TLS Documentation: Securing Connections for MariaDB Clients
2. Relevant Laravel Code: Illuminate\Database\Schema\MySqlSchemaState

Please let me know if more details are required. Happy to collaborate on resolving this!

[henzeb]

a workaround that works globally is creating a my.cnf file containing the following

[client]
skip-ssl = true

and add to your Dockerfile

ADD ./path/to/my.cnf /etc/my.cnf

[rayblair06]

Hey, thanks for the reply but I'm using MariaDB client so that wouldn't work. However it did lead me to this solution:

# my.cnf
[client]
ssl = false
ssl-verify-server-cert = false

# Dockerfile (PHP-FPM)
ADD ./my.cnf /etc/my.cnf.d/my.cnf

[nastoychev]

This is a great solution! For our local development, we use the mysql:8.0.42 image, which automatically generates all necessary certificates. Therefore, simply setting ssl-verify-server-cert = false should suffice, as it will still use the certificate without verifying it against the Trusted CA.

# my.cnf
[client]
ssl-verify-server-cert = false