Problem with MySQL: Production-Ready Docker Images for Craft

[foxtrotcz]

I was trying to create production ready Docker setup of Craft as per https://craftcms.com/knowledge-base/docker-in-production
I am using MySQL because that seems the most recommended database as per https://craftcms.com/knowledge-base/craft-database-options-and-best-practices

I have problem with MySQL backup and restore, from both CLI and dashboard.
Errors from CLI:
Backup:

Backing up the database ... error: The shell command "mysqldump '--defaults-file'='/tmp/fdiriropkuaa.cnf' '--add-drop-table' '--comments' '--create-options' '--dump-date' '--no-autocommit' '--routines' '--default-character-set'='utf8mb4' '--set-charset' '--triggers' '--no-tablespaces' '--no-data' '--skip-triggers' '--result-file'='/var/www/html/storage/backups/username--2026-04-26-151811--v5.9.20.sql' 'db' && mysqldump '--defaults-file'='/tmp/fdiriropkuaa.cnf' '--add-drop-table' '--comments' '--create-options' '--dump-date' '--no-autocommit' '--routines' '--default-character-set'='utf8mb4' '--set-charset' '--triggers' '--no-tablespaces' '--no-create-info' '--ignore-table'='db.assetindexdata' '--ignore-table'='db.cache' '--ignore-table'='db.imagetransformindex' '--ignore-table'='db.resourcepaths' '--ignore-table'='db.phpsessions' '--ignore-table'='db.sessions' 'db' >> "/var/www/html/storage/backups/username--2026-04-26-151811--v5.9.20.sql"" failed with exit code 2: mysqldump: Deprecated program name. It will be removed in a future release, use '/usr/bin/mariadb-dump' instead
mysqldump: Got error: 2026: "TLS/SSL error: self-signed certificate in certificate chain" when trying to connect

Restore:

Restoring database backup ... error: The shell command "mysql '--defaults-file'='/tmp/jxmkiidlqbsw.cnf' 'db' < "/var/www/html/storage/runtime/temp/bjrtpfdoqp/username--2026-04-26-123305--v5.9.20.sql"" failed with exit code 1: mysql: Deprecated program name. It will be removed in a future release, use '/usr/bin/mariadb' instead
ERROR 2026 (HY000): TLS/SSL error: self-signed certificate in certificate chain

Similar issues:
#17143
#18155

Could you please update the guide with production ready Dockerised Craft compatible with MySQL?

Looks like the problem is that the so-called "mysql-client" in Alpine is actually "mariadb-client".
I must say its annoying how Linux distros pretend MariaDB is MySQL and let people fight with the incompatibilities.
Relevant upstream issue: https://gitlab.alpinelinux.org/alpine/aports/-/issues/17798

Thanks.

[ajinp-dot]

Looks like this is a Craft CMS discussion link. If the issue there is related to MySQL/database corruption or broken DB tables, I’d usually try the normal recovery path first. Check the MySQL/MariaDB logs, verify the database service is healthy, and if InnoDB is damaged try recovery mode (innodb_force_recovery) just to get the database up long enough to export data. If the database files are damaged beyond normal repair, then a third-party recovery tool like Stellar Repair for MySQL can be an option. It can help recover corrupted MySQL/MariaDB databases, extract tables from damaged files, and save recovered data into a new database instead of working directly on the original files. For a Craft CMS install, I would also make a copy of the whole DB/data directory first, because the goal is to recover the content tables safely rather than risk making the corruption worse.

[cmargroff]

I have confirmed this error in an internal docker image as well. The issue is that CraftCMS running the mysqldump binary causes the SSL error above. I have tracked down the error to the --defaults-flie=/tmp/[randomid].cnf feature.

Here are the steps I have taken to test:

• I have taken the full command line and tried running it directly. This fails of course because the source temp cnf files is missing.
• I replaced the config file option with options for connection (host, user, password) information. This works.
• I added skip-ssl=true into the system mysqldump.cnf. This does not work
• I edited the code in vendor/craftcms/cms/db/mysql/Schema.php and had it append skip-ssl=true to the temp config. This works.

What I can take away from this is that when specifying --defaults-file option mysqldump will not use the system configuration for SSL which seems like a problem since the binary with defaults from the container are capable of connecting to the destination mysql server.

The only question is why this is a problem now and not before. The mysql container hasn't updated more than patch version and php only updated minor version. Craft updated from 5.8 to 5.10 however.

[brandonkelly]

I just PR’d a potential fix for that (#19366). @cmargroff would you mind testing that?

You can switch to the PR’s branch by changing your craftcms/cms requirement in composer.json to:

"craftcms/cms": "dev-feature/default-ssl-conf as 5.10.13",

Then run composer update craftcms/cms.