percona-xtradb-cluster-fips

packaged by Chainguard

Chainguard Container for percona-xtradb-cluster-fips

Percona XtraDB Cluster is a high-availability MySQL clustering solution based on Galera Cluster. It provides synchronous multi-master replication, automatic node provisioning, and tightly integrated write-set replication.

To get more information about the image, please visit the GitHub repository.

Chainguard Containers are regularly-updated, secure-by-default container images.

Download this Container Image

For those with access, this container image is available on cgr.dev:

docker pull cgr.dev/ORGANIZATION/percona-xtradb-cluster-fips:latest

Be sure to replace the ORGANIZATION placeholder with the name used for your organization's private repository within the Chainguard Registry.

Compatibility Notes

The Chainguard percona-xtradb-cluster-fips image is comparable to the percona/percona-xtradb-cluster image on Docker Hub. Like most Chainguard images, this container image is minimal and does not include unnecessary components such as a shell or package manager, while maintaining full compatibility.

FIPS Support

The percona-xtradb-cluster-fips Chainguard Image ships with a validated redistribution of the OpenSSL FIPS provider module. For more on FIPS support in Chainguard Images, consult the guide on FIPS-enabled Chainguard Images on Chainguard Academy.

This image runs MySQL with --ssl-fips-mode=STRICT enforced. You can validate FIPS mode is active by looking for the following message in the startup logs:

A FIPS-approved version of the OpenSSL cryptographic library has been detected in the operating system with a properly configured FIPS module available for loading. Percona Server for MySQL will load this module and run in FIPS mode.

Usage

Percona XtraDB Cluster (PXC) is a high-availability MySQL clustering solution based on Galera Cluster, providing synchronous multi-master replication. It is designed to run as a cluster of nodes and is typically deployed via the Percona Operator for MySQL.

Docker

Starting a Standalone Node

For local testing, start a single PXC FIPS node in standalone mode (not suitable for production — PXC requires at least 3 nodes for a proper cluster):

docker run -d \
  --name pxc-fips-node \
  -e MYSQL_ROOT_PASSWORD=root \
  cgr.dev/ORGANIZATION/percona-xtradb-cluster-fips:latest

View the container logs to confirm startup:

docker logs pxc-fips-node --follow

<details> <summary>Expected Output:</summary>

You can access the server when you see the "ready for connections" message in the log.

</details>

Accessing the Container

Use docker exec to open a shell inside the container:

docker exec -it pxc-fips-node /bin/sh

Accessing the Database

Connect to the MySQL interface once the node is ready:

docker exec -it pxc-fips-node mysql -uroot -proot

<details> <summary>Expected Output:</summary>

mysql: [Warning] Using a password on the command line interface can be insecure.
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 8
Server version: 8.4.x-y.z Percona XtraDB Cluster (GPL), ...

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

</details>

Kubernetes Deployment via Helm

PXC is designed for Kubernetes. The recommended approach is to deploy it using the Percona Operator for MySQL and the pxc-db Helm chart.

1. Install the PXC Operator

helm repo add percona https://percona.github.io/percona-helm-charts/
helm repo update

helm install pxc-operator percona/pxc-operator \
  --namespace pxc-operator \
  --create-namespace

2. Deploy a PXC FIPS Cluster

Create a values.yaml that points to the Chainguard FIPS image:

pxc:
  image:
    repository: cgr.dev/ORGANIZATION/percona-xtradb-cluster-fips
    tag: latest

Then deploy the cluster in the same namespace as the operator (the operator's RBAC is scoped to its own namespace by default):

helm install pxc-db percona/pxc-db \
  --namespace pxc-operator \
  -f values.yaml

3. Connect to the Cluster

Wait for all three PXC pods to reach Ready state:

kubectl wait --for=condition=ready pod \
  -l app.kubernetes.io/component=pxc \
  -n pxc-operator --timeout=600s

Retrieve the root password from the secret:

kubectl get secret pxc-db-secrets -n pxc-operator \
  -o jsonpath='{.data.root}' | base64 --decode

Connect directly to the cluster via one of the PXC pods:

ROOT_PASSWORD=$(kubectl get secret pxc-db-secrets -n pxc-operator \
  -o jsonpath='{.data.root}' | base64 --decode)

kubectl exec -n pxc-operator pxc-db-pxc-0 -c pxc -- \
  mysql -uroot -p"${ROOT_PASSWORD}" \
  -e "SELECT @@hostname, VERSION();"

For more information, refer to the Percona XtraDB Cluster documentation and the Percona Operator for MySQL documentation.

What are Chainguard Containers?

Chainguard's free tier of Starter container images are built with Wolfi, our minimal Linux undistro.

All other Chainguard Containers are built with Chainguard OS, Chainguard's minimal Linux operating system designed to produce container images that meet the requirements of a more secure software supply chain.

The main features of Chainguard Containers include:

• Minimal design, without unnecessary software bloat
• Daily builds to ensure container images are up-to-date with available security patches
• High quality build-time SBOMs attesting to the provenance of all artifacts within the image
• Verifiable signatures provided by Sigstore
• Reproducible builds with Cosign and apko (read more about reproducibility)

For cases where you need container images with shells and package managers to build or debug, most Chainguard Containers come paired with a development, or -dev, variant.

In all other cases, including Chainguard Containers tagged as :latest or with a specific version number, the container images include only an open-source application and its runtime dependencies. These minimal container images typically do not contain a shell or package manager.

Although the -dev container image variants have similar security features as their more minimal versions, they include additional software that is typically not necessary in production environments. We recommend using multi-stage builds to copy artifacts from the -dev variant into a more minimal production image.

Need additional packages?

To improve security, Chainguard Containers include only essential dependencies. Need more packages? Chainguard customers can use Custom Assembly to add packages, either through the Console, chainctl, or API.

To use Custom Assembly in the Chainguard Console: navigate to the image you'd like to customize in your Organization's list of images, and click on the Customize image button at the top of the page.

Learn More

Refer to our Chainguard Containers documentation on Chainguard Academy. Chainguard also offers VMs and Libraries — contact us for access.

Trademarks

This software listing is packaged by Chainguard. The trademarks set forth in this offering are owned by their respective companies, and use of them does not imply any affiliation, sponsorship, or endorsement by such companies.