Add root user for localhost

[wapolinar]

Grant all privileges to the root user for localhost.

This allows to execute mysql_secure_installation and remove remote
access from the root user while still being able to access the database
from localhost.

[tianon]

Why not instead do something like this as an initialization script? (something like /docker-entrypoint-initdb.d/localhost-root.sql)

UPDATE mysql.user SET host = 'localhost' WHERE user = 'root' AND host = '%' ;
FLUSH PRIVILEGES ;

[wapolinar]

Yes, of course, but wouldn't this change the behaviour (i.e., not allowing the root user to connect from other servers than "localhost")? If you wish, I will modify this request to your suggestion.

[yosifkit]

I think what @tianon is saying is that it is simple enough to add your own scripts to the initdb directory to accomplish the same thing for your own containers that it is not necessary to change the image.

[wapolinar]

Yes, I figured that after writing my message...
I thought executing "mysql_secure_installation" is a suggested method before bringing the database into production and since executing bash is described on the mariadb docker docs, it is not clear that root access will be lost, if it is executed on the normal, official docker mariadb image.

Nevertheless, as an alternative, it could be added a section to the readme that describes the steps on how remote root access is disabled without removing root access completely, which could involve the execution of such an initialization script.

[tianon]

Yeah, apart from removing root accounts that are accessible outside the "local" host (due to us knowing we're already inside a Docker container), I think we already implement the things that "mysql_secure_installation" changes, so it's probably worth documenting that, and what can be done for that final bit of ensuring "root" is only accessible from within the container itself (or via "--net container:some-mysql") for those who really want to go all the way.

[tianon]

Something similar to this was merged for https://github.com/docker-library/mysql in docker-library/mysql#249 -- looks like we need to do a "feature resync" again. 👍