docker pull mysql:9mysql@sha256:86b390ef642f89a0157d6215dee33ddc928b8b0ecab173117f56f6c40cb24eabSize per platform
Compressed download size on Docker Hub for each architecture.
Where the bytes go
Unpacked bytes by directory in the final amd64 filesystem.
Layers
The 10 filesystem layers of the amd64 image, in build order, with each layer's compressed size and the build step that made it.
Full build steps
- 47 MB
ADD oraclelinux-9-slim-amd64-rootfs.tar.xz / # buildkit - 885 B
RUN /bin/sh -c set -eux; groupadd --system --gid 999 mysql; useradd --system --uid 999 --gid 999 --home-dir /var/lib/mysql --no-create-home mysql # buildkit - 784 kB
RUN /bin/sh -c set -eux; arch="$(uname -m)"; case "$arch" in aarch64) gosuArch='arm64' ;; x86_64) gosuArch='amd64' ;; *) echo >&2 "error: unsupported architecture: '$arch'"; exit 1 ;; esac; curl -fL -o /usr/local/bin/gosu.asc "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$gosuArch.asc"; curl -fL -o /usr/local/bin/gosu "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$gosuArch"; export GNUPGHOME="$(mktemp -d)"; gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys B42F6819007F00F88E364FD4036A9C25BF357DD4; gpg --batch --verify /usr/l - 6.2 MB
RUN /bin/sh -c set -eux; microdnf install -y bzip2 gzip openssl xz zstd findutils ; microdnf clean all # buildkit - 3 kB
RUN /bin/sh -c set -eux; key='BCA4 3417 C3B4 85DD 128E C6D4 B7B3 B788 A8D3 785C'; export GNUPGHOME="$(mktemp -d)"; gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key"; gpg --batch --export --armor "$key" > /etc/pki/rpm-gpg/RPM-GPG-KEY-mysql; rm -rf "$GNUPGHOME" # buildkit - 334 B
RUN /bin/sh -c set -eu; { echo '[mysql9.7-server-minimal]'; echo 'name=MySQL 9.7 Server Minimal'; echo 'enabled=1'; echo 'baseurl=https://repo.mysql.com/yum/mysql-9.7-community/docker/el/9/$basearch/'; echo 'gpgcheck=1'; echo 'gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-mysql'; echo 'module_hotfixes=true'; } | tee /etc/yum.repos.d/mysql-community-minimal.repo # buildkit - 57 MB
RUN /bin/sh -c set -eux; microdnf install -y "mysql-community-server-minimal-$MYSQL_VERSION"; microdnf clean all; grep -F 'socket=/var/lib/mysql/mysql.sock' /etc/my.cnf; sed -i 's!^socket=.*!socket=/var/run/mysqld/mysqld.sock!' /etc/my.cnf; grep -F 'socket=/var/run/mysqld/mysqld.sock' /etc/my.cnf; { echo '[client]'; echo 'socket=/var/run/mysqld/mysqld.sock'; } >> /etc/my.cnf; ! grep -F '!includedir' /etc/my.cnf; { echo; echo '!includedir /etc/mysql/conf.d/'; } >> /etc/my.cnf; mkdir -p /etc/mysql/conf.d; mkdir -p /var/lib/mysql /var/run/mysqld; chown mysql:mysql /var/lib/mysql /var/ - 320 B
RUN /bin/sh -c set -eu; { echo '[mysql-tools-community]'; echo 'name=MySQL Tools Community'; echo 'baseurl=https://repo.mysql.com/yum/mysql-tools-9.7-community/el/9/$basearch/'; echo 'enabled=1'; echo 'gpgcheck=1'; echo 'gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-mysql'; echo 'module_hotfixes=true'; } | tee /etc/yum.repos.d/mysql-community-tools.repo # buildkit - 159 MB
RUN /bin/sh -c set -eux; microdnf install -y "mysql-shell-$MYSQL_SHELL_VERSION"; microdnf clean all; mysqlsh --version # buildkit - 5 kB
COPY docker-entrypoint.sh /usr/local/bin/ # buildkit
Known vulnerabilities
2Critical2 with a fix
33High33 with a fix
40Medium40 with a fix
7Low6 with a fix
1Unknown1 with a fix
83 findings across 149 packages; 82 have a fixed version upstream, so rebuilding or updating packages clears them. The rest have no fix released yet; distributions often mark these “will not fix” or “deferred” for issues that do not affect the packaged build.
| Severity | Vulnerability | Affected packages | Fixed in |
|---|---|---|---|
| Critical | CVE-2025-68121crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption | stdlibinstalled v1.24.6 | 1.24.13, 1.25.7, 1.26.0-rc.3 |
| Critical | GHSA-6q48-6c7w-9gw2certifi bundles emSign root CAs with compromised intermediate CA keys | certifiinstalled 2026.2.25 | 2026.10.18 |
| High | CVE-2025-61726golang: net/url: Memory exhaustion in query parameter parsing in net/url | stdlibinstalled v1.24.6 | 1.24.12, 1.25.6 |
| High | CVE-2025-61729crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate | stdlibinstalled v1.24.6 | 1.24.11, 1.25.5 |
| High | CVE-2026-111943crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates | stdlibinstalled v1.24.6 | 1.26.10, 1.27.3 |
| High | CVE-2026-25679net/url: Incorrect parsing of IPv6 host literals in net/url | stdlibinstalled v1.24.6 | 1.25.8, 1.26.1 |
| High | CVE-2026-27145crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries | stdlibinstalled v1.24.6 | 1.25.11, 1.26.4 |
| High | CVE-2026-27459pyOpenSSL: DTLS cookie callback buffer overflow | pyOpenSSLinstalled 25.3.0 | 26.0.0 |
| High | CVE-2026-32280crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building | stdlibinstalled v1.24.6 | 1.25.9, 1.26.2 |
| High | CVE-2026-32281crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation | stdlibinstalled v1.24.6 | 1.25.9, 1.26.2 |
| High | CVE-2026-32283crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages | stdlibinstalled v1.24.6 | 1.25.9, 1.26.2 |
| High | CVE-2026-33811net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME | stdlibinstalled v1.24.6 | 1.25.10, 1.26.3 |
| High | CVE-2026-33814net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame | stdlibinstalled v1.24.6 | 1.25.10, 1.26.3 |
| High | CVE-2026-33818encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal | stdlibinstalled v1.24.6 | 1.25.13, 1.26.6, 1.27.0-rc.3 |
| High | CVE-2026-39820net/mail: golang: Go net/mail: Denial of Service via crafted email inputs | stdlibinstalled v1.24.6 | 1.25.10, 1.26.3 |
| High | CVE-2026-39821golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing | stdlibinstalled v1.24.6 | 1.25.13, 1.26.6, 1.27.0-rc.3 |
| High | CVE-2026-39822golang: Go os.Root: Symlink following vulnerability allows directory traversal | stdlibinstalled v1.24.6 | 1.25.12, 1.26.5, 1.27.0-rc.2 |
| High | CVE-2026-39836net: golang: Go net package: Denial of Service via NUL byte in Dial and LookupPort on Windows | stdlibinstalled v1.24.6 | 1.25.10, 1.26.3 |
| High | CVE-2026-42499net/mail: golang: net/mail: Denial of Service via pathological email address parsing | stdlibinstalled v1.24.6 | 1.25.10, 1.26.3 |
| High | CVE-2026-42504mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header | stdlibinstalled v1.24.6 | 1.25.11, 1.26.4 |
| High | CVE-2026-44431urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers | urllib3installed 2.6.3 | 2.7.0 |
| High | CVE-2026-44432urllib3: urllib3: Denial of Service due to excessive HTTP response decompression | urllib3installed 2.6.3 | 2.7.0 |
| High | CVE-2026-56853net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service | stdlibinstalled v1.24.6 | 1.25.13, 1.26.6, 1.27.0-rc.3 |
| High | CVE-2026-56858html/template: golang: Go html/template: Cross-Site Scripting via pathological input | stdlibinstalled v1.24.6 | 1.25.13, 1.26.6, 1.27.0-rc.3 |
| High | CVE-2026-56859encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue | stdlibinstalled v1.24.6 | 1.25.13, 1.26.6, 1.27.0-rc.3 |
| High | CVE-2026-56860net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution | stdlibinstalled v1.24.6 | 1.25.13, 1.26.6, 1.27.0-rc.3 |
| High | CVE-2026-56862crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages | stdlibinstalled v1.24.6 | 1.25.13, 1.26.6, 1.27.0-rc.3 |
| High | CVE-2026-69247python-cryptography: python-cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and | cryptographyinstalled 46.0.5 | 50.0.0 |
| High | CVE-2026-69249python-cryptography: python-cryptography: Duplicate self-signed intermediates can cause exponential path-building | cryptographyinstalled 46.0.5 | 49.0.0 |
| High | CVE-2026-78667net/http: golang: golang: Denial of Service via crafted HTTP Range headers | stdlibinstalled v1.24.6 | 1.26.9, 1.27.2 |
| High | CVE-2026-78669net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames | stdlibinstalled v1.24.6 | 1.26.9, 1.27.2 |
| High | CVE-2026-97031crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references | stdlibinstalled v1.24.6 | 1.26.9, 1.27.2 |
| High | CVE-2026-97687urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override | urllib3installed 2.6.3 | 2.8.0 |
| High | CVE-2026-97689urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser | urllib3installed 2.6.3 | 2.8.0 |
| High | GHSA-537c-gmf6-5ccfVulnerable OpenSSL included in cryptography wheels | cryptographyinstalled 46.0.5 | 48.0.1 |
| Medium | CVE-2025-47912net/url: Insufficient validation of bracketed IPv6 hostnames in net/url | stdlibinstalled v1.24.6 | 1.24.8, 1.25.2 |
| Medium | CVE-2025-58183golang: archive/tar: Unbounded allocation when parsing GNU sparse map | stdlibinstalled v1.24.6 | 1.24.8, 1.25.2 |
| Medium | CVE-2025-58185encoding/asn1: Parsing DER payload can cause memory exhaustion in encoding/asn1 | stdlibinstalled v1.24.6 | 1.24.8, 1.25.2 |
| Medium | CVE-2025-58187crypto/x509: Quadratic complexity when checking name constraints in crypto/x509 | stdlibinstalled v1.24.6 | 1.24.9, 1.25.3 |
| Medium | CVE-2025-58188crypto/x509: golang: Panic when validating certificates with DSA public keys in crypto/x509 | stdlibinstalled v1.24.6 | 1.24.8, 1.25.2 |
Showing the 40 most severe of 82 distinct vulnerabilities (83 findings, one per affected package).
Packages
- RPM packages
- 117
- Python packages
- 20
- npm packages
- 8
- Go modules
- 4
Image configuration
- Base OS
- Oracle Linux 9.8
- Default user
- root (no USER set; the entrypoint may still drop privileges)
- Entrypoint
- docker-entrypoint.sh
- Command
- mysqld
- Exposed ports
- 3306/tcp, 33060/tcp
- Image created
- 2026-10-27
- amd64 digest
- sha256:b055723a00649bde974d2e3d3ba486725f279c4a4bb4d24d69f36b11fafa7b79
Other MySQL tags
Platform sizes and layers: Docker Hub API, checked 2026-11-01. Unpacked size, files and SBOM: measured 2026-10-31 from digest sha256:b055723a0064. Vulnerabilities: Trivy re-scan 2026-11-01, database 2026-11-01. Methodology.