fix(dockerfile): update alpine base files

- resolve CVE-2021-3711, CVE-2021-3712

.gitattributes

@@ -20,7 +20,7 @@
 *.PDF      diff=astextplain
 *.rtf      diff=astextplain
 *.RTF      diff=astextplain
-*.md       text
+*.md       text diff=markdown
 *.tex      text diff=tex
 *.adoc     text
 *.textile  text
@@ -30,6 +30,7 @@
 *.tsv      text
 *.txt      text
 *.sql      text
+*.ps1      text eol=crlf
 
 # Graphics
 *.png      binary
@@ -53,7 +54,23 @@
 # These are explicitly windows files and should use crlf
 *.bat      text eol=crlf
 *.cmd      text eol=crlf
-*.ps1      text eol=crlf
+
+# web frontend stack -- force LF so SRI hashes are always correct
+*.html     text eol=lf
+*.htm      text eol=lf
+*.css      text eol=lf
+*.min.css  text eol=lf
+*.js       text eol=lf
+*.min.js   text eol=lf
+*.php      text eol=lf
+
+# Visual Studio projects (Rider also)
+*.cs     diff=csharp
+*.sln    merge=union
+*.csproj merge=union
+*.vbproj merge=union
+*.fsproj merge=union
+*.dbproj merge=union
 
 # Serialisation
 *.json     text
@@ -79,4 +96,5 @@
 .gitattributes  export-ignore
 .gitignore      export-ignore
 .gitkeep        export-ignore
+.idea           export-ignore
 .vscode         export-ignore

.gitignore

@@ -1,11 +1,73 @@
-# VSCode files
+### JetBrains template
-.vscode/*
+# Covers JetBrains IDEs: IntelliJ, RubyMine, PhpStorm, AppCode, PyCharm, CLion, Android Studio, WebStorm and Rider
-!.vscode/settings.json
+# Reference: https://intellij-support.jetbrains.com/hc/en-us/articles/206544839
-!.vscode/tasks.json
+
-!.vscode/launch.json
+# User-specific stuff
-!.vscode/extensions.json
+.idea/**/workspace.xml
-!.vscode/numbered-bookmarks.json
+.idea/**/tasks.xml
-*.code-workspace
+.idea/**/usage.statistics.xml
+.idea/**/dictionaries
+.idea/**/shelf
+
+# Generated files
+.idea/**/contentModel.xml
+
+# Sensitive or high-churn files
+.idea/**/dataSources/
+.idea/**/dataSources.ids
+.idea/**/dataSources.local.xml
+.idea/**/sqlDataSources.xml
+.idea/**/dynamic.xml
+.idea/**/uiDesigner.xml
+.idea/**/dbnavigator.xml
+
+# Gradle
+.idea/**/gradle.xml
+.idea/**/libraries
+
+# Gradle and Maven with auto-import
+# When using Gradle or Maven with auto-import, you should exclude module files,
+# since they will be recreated, and may cause churn.  Uncomment if using
+# auto-import.
+# .idea/artifacts
+# .idea/compiler.xml
+# .idea/jarRepositories.xml
+# .idea/modules.xml
+# .idea/*.iml
+# .idea/modules
+# *.iml
+# *.ipr
+
+# CMake
+cmake-build-*/
+
+# Mongo Explorer plugin
+.idea/**/mongoSettings.xml
+
+# File-based project format
+*.iws
+
+# IntelliJ
+out/
+
+# mpeltonen/sbt-idea plugin
+.idea_modules/
+
+# JIRA plugin
+atlassian-ide-plugin.xml
+
+# Cursive Clojure plugin
+.idea/replstate.xml
+
+# Crashlytics plugin (for Android Studio and IntelliJ)
+com_crashlytics_export_strings.xml
+crashlytics.properties
+crashlytics-build.properties
+fabric.properties
+
+# Editor-based Rest Client
+.idea/httpRequests
+
+# Android studio 3.1+ serialized cache file
+.idea/caches/build_file_checksums.ser
 
-# Local History for Visual Studio Code
-.history/

.idea/.idea.ab-mariadb-alpine.dir/.idea/indexLayout.xml

@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <project version="4">
-  <component name="ContentModelUserStore">
+  <component name="UserContentModel">
     <attachedFolders />
     <explicitIncludes />
     <explicitExcludes />

.idea/.idea.ab-mariadb-alpine.dir/.idea/riderModule.iml

@@ -1,7 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<module type="RIDER_MODULE" version="4">
-  <component name="NewModuleRootManager">
-    <content url="file://$MODULE_DIR$/../.." />
-    <orderEntry type="sourceFolder" forTests="false" />
-  </component>
-</module>

.vscode/numbered-bookmarks.json

@@ -1,3 +0,0 @@
-{
-	"bookmarks": []
-}

Dockerfile

@@ -2,20 +2,22 @@
 ### mariadb running on Alpine Linux
 #
 
-FROM alpine:3.12
+FROM alpine:3.14
 
 # standardized labels
-LABEL maintainer="Asif Bacchus <asif@bacchus.cloud>"
+MAINTAINER Asif Bacchus <asif@asifbacchus.dev>
-LABEL org.label-schema.cmd="docker run -d --name db -v volume:/var/lib/mysql [-v /pre/exec/scripts:/docker-entrypoint-preinit.d] [-v /sql/scripts:/docker-entrypoint-initdb.d] [-v /post/exec/scripts:/docker-entrypoint-postinit.d] [-e TZ=Etc/UTC -e MYSQL_UID=8100 -e MYSQL_GID=8100 -e MYSQL_ROOT_PASSWORD=... -e MYSQL_DATABASE='myData' -e MYSQL_CHARSET='utf8mb4' -e MYSQL_COLLATION='utf8mb4_general_ci' -e MYSQL_USER=... -e MYSQL_PASSWORD=...] docker.asifbacchus.app/mariadb/ab-mariadb-alpine:latest"
+LABEL dev.asifbacchus.docker.internalName="ab-mariadb-alpine"
-LABEL org.label-schema.description="mariadb running on Alpine Linux."
+LABEL org.opencontainer.image.authors="Asif Bacchus <asif@asifbacchus.dev>"
-LABEL org.label-schema.name="ab-mariadb-alpine"
+LABEL org.opencontainer.image.description=""
-LABEL org.label-schema.schema-version="1.0"
+LABEL org.opencontainer.image.documentation="https://git.asifbacchus.dev/ab-docker/ab-mariadb-alpine/raw/branch/main/README.md"
-LABEL org.label-schema.url="https://git.asifbacchus.app/ab-docker/ab-mariadb-alpine"
+LABEL org.opencontainer.image.source="https://git.asifbacchus.dev/ab-docker/ab-mariadb-alpine.git"
-LABEL org.label-schema.usage="https://git.asifbacchus.app/ab-docker/ab-mariadb-alpine/src/branch/master/README.md"
+LABEL org.opencontainer.image.title="ab-mariadb-alpine"
-LABEL org.label-schema.vcs-url="https://git.asifbacchus.app/ab-docker/ab-mariadb-alpine.git"
+LABEL org.opencontainer.image.url="https://git.asifbacchus.dev/ab-docker/ab-mariadb-alpine"
+LABEL org.opencontainer.image.vendor="Asif Bacchus <asif@asifbacchus.dev>"
 
 # install mariadb and turn on TCP connection in default config
-RUN apk --no-cache --repository=http://dl-cdn.alpinelinux.org/alpine/edge/main add \
+RUN apk --update --no-cache upgrade \
+    && apk --update --no-cache --repository=http://dl-cdn.alpinelinux.org/alpine/edge/main add \
         tzdata \
         mariadb \
         mariadb-client \
@@ -29,6 +31,14 @@ EXPOSE 3306
 # create volume if user forgets
 VOLUME ["/var/lib/mysql"]
 
+# basic healthcheck (service only)
+HEALTHCHECK \
+    --interval=30s \
+    --timeout=10s \
+    --start-period=30s \
+    --retries=3 \
+    CMD mysqladmin ping --silent
+
 # set environment variables
 ENV TZ=Etc/UTC
 ENV MYSQL_UID=8100
@@ -51,8 +61,15 @@ RUN mkdir -p /docker-entrypoint-preinit.d \
 ENTRYPOINT [ "/usr/local/bin/entrypoint.sh" ]
 CMD [ "/usr/bin/mysqld", "--user=mysql", "--console" ]
 
-# add build date and version labels
+# add parameters, version and build date labels
+# set build timestamp and version labels
+ARG MARIADB_VERSION
+ARG INTERNAL_VERSION
+ARG GIT_COMMIT
 ARG BUILD_DATE
-LABEL org.label-schema.build-date=${BUILD_DATE}
+LABEL dev.asifbacchus.docker.internalVersion=${INTERNAL_VERSION}
-LABEL org.label-schema.vendor="mariaDB (10.4.15-r0)"
+LABEL org.opencontainers.image.version="${INTERNAL_VERSION}-${MARIADB_VERSION}"
-LABEL org.label-schema.version="1.0"
+LABEL org.opencontainers.image.revision=${GIT_COMMIT}
+LABEL org.opencontainers.image.created=${BUILD_DATE}
+
+#EOF

README.md

@@ -1,57 +1,94 @@
 # MariaDB on Alpine Linux (dockerized)
 
-Fully functional dockerized installation of MariaDB server and client running on Alpine Linux. This container is roughly half the size of the official MariaDB container which runs on Ubuntu but still aims to mimic all its features while adding a few extra ;-)
+Fully functional dockerized installation of MariaDB server and client running on Alpine Linux. This container is roughly
+half the size of the official MariaDB container which runs on Ubuntu but still aims to mimic all its features while
+adding a few extra ;-) Note that this container is built against the Alpine EDGE repository for newer versions of
+mariaDB.
+
+<!-- toc -->
 
 - [Quick Start](#quick-start)
-  - [Pull the image](#pull-the-image)
+  * [Pull the image](#pull-the-image)
-  - [Run the image](#run-the-image)
+    + [Signed images](#signed-images)
-  - [Create a database](#create-a-database)
+  * [Run the image](#run-the-image)
-    - [Root password](#root-password)
+  * [Create a database](#create-a-database)
-    - [User password](#user-password)
+    + [Root password](#root-password)
+    + [User password](#user-password)
 - [Connecting as a client](#connecting-as-a-client)
-  - [Direct-to-Container](#direct-to-container)
+  * [Direct-to-Container](#direct-to-container)
-  - [Separate Container](#separate-container)
+  * [Separate Container](#separate-container)
 - [Shell Access](#shell-access)
 - [Checking Logs](#checking-logs)
 - [Environment Variables](#environment-variables)
-  - [System-related](#system-related)
+  * [System-related](#system-related)
-  - [MariaDB configuration](#mariadb-configuration)
+  * [MariaDB configuration](#mariadb-configuration)
-  - [Database configuration](#database-configuration)
+  * [Database configuration](#database-configuration)
 - [Root Account](#root-account)
-  - [Integrated-account](#integrated-account)
+  * [Integrated-account](#integrated-account)
-  - [Root-at-any-host](#root-at-any-host)
+  * [Root-at-any-host](#root-at-any-host)
 - [Data Persistence](#data-persistence)
 - [Data instantiation/import](#data-instantiationimport)
-  - [Existing DB (mysql directory)](#existing-db-mysql-directory)
+  * [Existing DB (mysql directory)](#existing-db-mysql-directory)
-  - [Instantiation](#instantiation)
+  * [Instantiation](#instantiation)
 - [Custom Scripts](#custom-scripts)
-  - [Entrypoint Task Order](#entrypoint-task-order)
+  * [Entrypoint Task Order](#entrypoint-task-order)
 - [Custom Configuration](#custom-configuration)
-  - [Command-line parameters](#command-line-parameters)
+  * [Command-line parameters](#command-line-parameters)
-  - [Configuration file(s)](#configuration-files)
+  * [Configuration file(s)](#configuration-files)
 - [Database dumps](#database-dumps)
+- [Healthcheck](#healthcheck)
 - [Source](#source)
 - [Final Thoughts](#final-thoughts)
 
+<!-- tocstop -->
+
 ## Quick Start
 
 ### Pull the image
 
-The latest images are on my private Docker Repo but I also try to keep the ones on Dockerhub updated within a few days. As such, you have two choices:
+The latest images are on my private docker registry. I also try to keep the ones on Dockerhub updated within a few
+days.
 
 ```bash
-# my private repo
+# pull from my private repo
-docker pull docker.asifbacchus.app/mariadb/ab-mariadb-alpine:latest
+docker pull docker.asifbacchus.dev/mariadb/ab-mariadb-alpine:latest
-```
 
-or
+# pull from dockerhub
-
-```bash
-# dockerhub
 docker pull asifbacchus/ab-mariadb-alpine:latest
 ```
 
-All the examples in this document will refer to my repo, but you can use Dockerhub if you prefer.
+The examples in this document will refer to dockerhub, but know that anywhere you
+see `asifbacchus/ab-mariadb-alpine:tag` you can use `docker.asifbacchus.app/mariadb/ab-mariadb-alpine:tag` to use my
+registry instead.
+
+#### Signed images
+
+I have abandoned using Docker's signing mechanisms in favour of [CodeNotary](https://codenotary.io). Not only are they free, they offer several big advantages including avoiding Docker's weird and over-complicated key management system. The only drawback is that verifying images requires you downloading their [client software](https://github.com/codenotary/vcn/releases) which is free to use and does not require an account for verifying images or anything else. On Linux, you can simply rename the downloaded file `vcn` and place it somewhere in your path like `/usr/local/bin`, make it executable and then you can verify this image. Here's an example, obviously you need to modify it for your environment:
+
+```sh
+# run commands as root
+sudo -s
+
+# download vcn to proper location
+wget https://github.com/vchain-us/vcn/releases/download/v0.9.9/vcn-v0.9.9-linux-amd64 -O /usr/local/bin/vcn
+chmod +x /usr/local/bin/vcn
+
+# make sure it works
+vcn --version
+
+# verify container image
+vcn authenticate docker://asifbacchus/ab-mariadb-alpine:latest
+```
+
+If you want to confirm the image is authentic before each run, you can do:
+
+```sh
+vcn verify docker://asifbacchus/ab-mariadb-alpine:latest && docker run ... docker://asifbacchus/ab-mariadb-alpine:latest
+```
+
+Since you are making verification a prerequisite to running the docker command (i.e. using `&&`), you can be sure that you are working with a verified and signed image.
+
+You can get more information on installing the client software for different platforms [here](https://docs.codenotary.io/guide/quickhelp.html#installing-the-codenotary-tools).
 
 ### Run the image
 
@@ -64,7 +101,7 @@ docker run -d \
     -e MYSQL_DATABASE='CompanyX' \
     -e MYSQL_USER='JaneDoe' \
     -e MYSQL_PASSWORD='JanesPa$$w0rd' \
-    docker.asifbacchus.app/mariadb/ab-mariadb-alpine
+    asifbacchus/ab-mariadb-alpine
 ```
 
 Let's take a quick overview of the options used above:
@@ -74,7 +111,7 @@ Let's take a quick overview of the options used above:
 Assuming an existing database does not exist in the container's data directory already, it will create an empty database for you. The name of this database is controlled by the environment variable `MYSQL_DATABASE`. This defaults to 'myData'. If you would like to create a database called 'CompanyX', for example, you would set the environment variable as follows:
 
 ```bash
-docker run -d -e MYSQL_DATABASE='CompanyX' docker.asifbacchus.app/mariadb/ab-mariadb-alpine
+docker run -d -e MYSQL_DATABASE='CompanyX' asifbacchus/ab-mariadb-alpine
 ```
 
 #### Root password
@@ -84,7 +121,7 @@ If you do not set a root password for mySQL, the container will generate one for
 In normal usage, you will want to set the root password instead of having it generated for you. This is accomplished by setting the environment variable `MYSQL_ROOT_PASSWORD`. The command would look something like:
 
 ```bash
-docker run -d -e MYSQL_ROOT_PASSWORD='SuPeR$ecurEP@$$w0rd' docker.asifbacchus.app/mariadb/ab-mariadb-alpine
+docker run -d -e MYSQL_ROOT_PASSWORD='SuPeR$ecurEP@$$w0rd' asifbacchus/ab-mariadb-alpine
 ```
 
 #### User password
@@ -92,7 +129,7 @@ docker run -d -e MYSQL_ROOT_PASSWORD='SuPeR$ecurEP@$$w0rd' docker.asifbacchus.ap
 If you would like a user account created for you with FULL privileges to the database created by the container, you must set two environment variables: `MYSQL_USER` and `MYSQL_PASSWORD`. You can do that as follows:
 
 ```bash
-docker run -d -e MYSQL_USER='JaneDoe' -e MYSQL_PASSWORD='JanesPa$$w0rd' docker.asifbacchus.app/mariadb/ab-mariadb-alpine
+docker run -d -e MYSQL_USER='JaneDoe' -e MYSQL_PASSWORD='JanesPa$$w0rd' asifbacchus/ab-mariadb-alpine
 ```
 
 ## Connecting as a client
@@ -114,7 +151,7 @@ This will log you into the container using the root account and connect you to M
 You can launch another instance of the container and use that as a client to connect to your server container or any other remote MariaDB/mySQL instance. In this case, we don't want to pass any environment variables, but we want to pass a separate CMD parameter as follows:
 
 ```bash
-docker run -it --rm docker.asifbacchus.app/mariadb/ab-mariadb-alpine mysql -hmysql.host.tld -uusername -ppassword
+docker run -it --rm asifbacchus/ab-mariadb-alpine mysql -hmysql.host.tld -uusername -ppassword
 ```
 
 **N.B.* I used the `--rm` Docker parameter to automatically remove the container on exit. This is optional.
@@ -194,10 +231,10 @@ By default, the container will create a volume to store your mySQL database so y
 
 ```bash
 # create a volume or use an existing named-volume
-docker run -d -v mydatabase:/var/lib/mysql docker.asifbacchus.app/mariadb/ab-mariadb-alpine
+docker run -d -v mydatabase:/var/lib/mysql asifbacchus/ab-mariadb-alpine
 
 # use a bind-mount location
-docker run -d -v /my/local/dir:/var/lib/mysql docker.asifbacchus.app/mariadb/ab-mariadb-alpine
+docker run -d -v /my/local/dir:/var/lib/mysql asifbacchus/ab-mariadb-alpine
 ```
 
 ## Data instantiation/import
@@ -207,7 +244,7 @@ docker run -d -v /my/local/dir:/var/lib/mysql docker.asifbacchus.app/mariadb/ab-
 The entrypoint script of the container simply checks to see if the */var/lib/mysql* directory is empty and, if so, creates a new database for you. Thus, if you want to import an existing database, you simply have to mount a valid *mysql* subdirectory:
 
 ```bash
-docker run -d -v /existing/mysql:/var/lib/mysql docker.asifbacchus.app/mariadb/ab-mariadb-alpine
+docker run -d -v /existing/mysql:/var/lib/mysql asifbacchus/ab-mariadb-alpine
 ```
 
 ### Instantiation
@@ -215,13 +252,13 @@ docker run -d -v /existing/mysql:/var/lib/mysql docker.asifbacchus.app/mariadb/a
 If you want to 'instantiate' your newly created database (add tables, some default data, set privileges, etc.) then you can import SQL files with commands preloaded. Any *.sql* or *.sql.gz* files mounted in the container's */docker-entrypoint-initdb.d* folder will be imported after the new database is created.
 
 ```bash
-docker run -d -v /sql/import/scripts:/docker-entrypoint-initdb.d docker.asifbacchus.app/mariadb/ab-mariadb-alpine
+docker run -d -v /sql/import/scripts:/docker-entrypoint-initdb.d asifbacchus/ab-mariadb-alpine
 ```
 
 You should review the logs when doing this to see if MariaDB throws any errors due to syntax errors or other mistakes in your SQL files. An easy way to do this is:
 
 ```bash
-docker run -d --name db -v /sql/import/scripts:/docker-entrypoint-initdb.d docker.asifbacchus.app/mariadb/ab-mariadb-alpine && docker logs -f db
+docker run -d --name db -v /sql/import/scripts:/docker-entrypoint-initdb.d asifbacchus/ab-mariadb-alpine && docker logs -f db
 ```
 
 You can, of course, name your container anything you like. Just change *'db'* in both places to whatever you choose.
@@ -238,7 +275,7 @@ To run scripts after MariaDB is initialized (i.e. after a database is created an
 docker run -d \
     -v /my/pre-init/scripts:/docker-entrypoint-preinit.d \
     -v /my/post-init/scripts:/docker-entrypoint-postinit.d \
-    docker.asifbacchus.app/mariadb/ab-mariadb-alpine
+    asifbacchus/ab-mariadb-alpine
 ```
 
 ### Entrypoint Task Order
@@ -267,7 +304,7 @@ For reference, the sequence of events in the entrypoint script is:
 You can pass MariaDB command-line parameters to your container just as your would with a regular *mysqld* instance. For example:
 
 ```bash
-docker run -d docker.asifbacchus.app/mariadb/ab-mariadb-alpine --innodb-ft-min-token-size=2
+docker run -d asifbacchus/ab-mariadb-alpine --innodb-ft-min-token-size=2
 ```
 
 The container will concatenate any parameters your supply with the default ones of *--console --user=mysql*. Note that command-line parameters override environment variable parameters supplied to the container.
@@ -280,12 +317,12 @@ If you would like to use a completely custom MariaDB configuration you will need
 # custom my.cnf
 docker run -d \
     -v /mysql/configuration/my.cnf:/etc/my.cnf \
-    docker.asifbacchus.app/mariadb/ab-mariadb-alpine
+    asifbacchus/ab-mariadb-alpine
 
 # custom server-related files
 docker run -d \
     -v /mysql/server-config:/etc/my.cnf.d \
-    docker.asifbacchus.app/mariadb/ab-mariadb-alpine
+    asifbacchus/ab-mariadb-alpine
 
 # complex configuration using custom my.cnf
 # this completely depends on how you specify things in my.cnf
@@ -293,7 +330,7 @@ docker run -d \
     -v /mysql/config/my.cnf:/etc/my.cnf \
     -v /mysql/other-config:/etc/mysql/some-directory \
     -v /mysql/more-configs:/etc/mysql/cnf/another-dir \
-    docker.asifbacchus.app/mariadb/ab-mariadb-alpine
+    asifbacchus/ab-mariadb-alpine
 ```
 
 You should be aware that the container passes *'--console --user=mysql'* command-line parameters to *mysqld* by default and that will override parameters specified in *my.cnf* or any other configuration file. If you need to override these defaults, you will have to pass the *mysqld* command manually:
@@ -301,7 +338,7 @@ You should be aware that the container passes *'--console --user=mysql'* command
 ```bash
 docker run -d \
     -v /mysql/configuration/my.cnf:/etc/my.cnf \
-    docker.asifbacchus.app/mariadb/ab-mariadb-alpine \
+    asifbacchus/ab-mariadb-alpine \
     mysqld --user=anotheruser
 ```
 
@@ -334,6 +371,12 @@ docker exec -it container_name /bin/sh -c 'exec mysql' < /local/path/mySQLdumps/
 docker exec -it container_name /bin/sh -c 'exec mysql -uroot -p"SuPeR$ecurEP@$$w0rd"' < /local/path/mySQLdumps/filename.sql
 ```
 
+## Healthcheck
+
+Starting with internal version 2.0-10.6.4-r0, I've added a very basic healthcheck to the container. It simply checks that the mysqld daemon is running in the container and accepting connections. It **does NOT** check anything to do with the actual database. As such, you may want to override this with a more specific healthcheck for your particular use-case. If you just need to know MariaDB is actually running though, this healthcheck will work just fine.
+
+If anyone has suggestions for a better healthcheck, PLEASE let me know!
+
 ## Source
 
 The source for this container build (Dockerfile, entrypoint.sh) are available on my [private git repo](https://git.asifbacchus.app/ab-docker/mariadb-alpine) or on [GitHub](https://github.com/asifbacchus/ab-mariadb-alpine.git). Note that the newest versions will be on my repo and GitHub will be updated at most a few days later. Also, I'd prefer issues be filed on my repo, but I understand if GitHub is easier/more familiar for you.

entrypoint.sh

@@ -19,6 +19,7 @@ isInt () {
 
 # instantiate variables
 sqlCmd='/tmp/cmd.sql'
+showRootPassword=0
 
 # convert env variables to uppercase for proper string comparison
 MYSQL_SKIP_NAME_RESOLVE=$(convertCase "$MYSQL_SKIP_NAME_RESOLVE")
@@ -48,6 +49,7 @@ fi
 if [ -z "$MYSQL_ROOT_PASSWORD" ]; then
     MYSQL_ROOT_PASSWORD="$( head /dev/urandom | tr -dc A-Za-z0-9 | head -c32 )"
     export MYSQL_ROOT_PASSWORD=$MYSQL_ROOT_PASSWORD
+    showRootPassword=1
 fi
 
 # change mysql UID & GID
@@ -159,7 +161,9 @@ done
 
 # note initialization complete and display root password
 printf "\nInitialization complete...\n"
-printf "(mySQL root password: %s)\n\n" "$MYSQL_ROOT_PASSWORD"
+if [ "$showRootPassword" -eq 1 ]; then
+    printf "(mySQL root password: %s)\n\n" "$MYSQL_ROOT_PASSWORD"
+fi
 
 # process CMD sent to this container
 case "$1" in