MySQL Community Server (Hardened) — documentation & support card

At a glance

Type	Hardened VM image
Upstream / license	MySQL Community Server (GPL-2.0 (with FOSS exception)) — see licenses
Version	MySQL Community 8.4 LTS from the official repo.mysql.com packages (AWS image); MySQL 8.0 from the Ubuntu 24.04 packages (GCE image — chosen because Ubuntu's build loads auth_socket by default). Current builds: release notes.
Architecture	x86-64
Sizing	Any current-generation instance with ≥ 4 vCPU (pay-as-you-go floor); 8 vCPU recommended for production.

Marketplaces

• AWS Marketplace — view listing (base: Amazon Linux 2023 (EL9 packages, MySQL 8.4))
• Google Cloud Marketplace — public on Google Cloud Marketplace (Compute Engine VM image + deployment package) (base: Ubuntu 24.04 LTS (MySQL 8.0))

Network ports

Port	Purpose	State
22	SSH (key-only)	default-open
3306	MySQL client protocol — bound to 127.0.0.1	customer-must-open (config + firewall)
33060	MySQL X protocol — disabled/loopback	optional

"customer-must-open" means a cloud firewall rule and, where noted, an in-image configuration change — both deliberate. Closed by default is the design.

Access & credentials

No shared or default credentials are included in this image. Access uses the SSH key you supply at launch; any application credential is generated uniquely on your instance at first boot and stored only there — we never know it.

Log in: SSH with your launch key pair, then `sudo mysql` for a root database shell.

MySQL root uses auth_socket — no password exists at all.

sudo mysql   # connects as root via the unix socket

Rotation: Not applicable to root (socket auth). For app users you create: ALTER USER ... IDENTIFIED BY with your own secret.

Step-by-step: first login / credentials.

Data & dependencies

• Data locations: /var/lib/mysql — all data stays on your instance and volumes.
• Does any data leave your tenant? No. Telemetry: none. Our images contain no phone-home, no usage beacons, no license servers. The only parties that know you deployed our software are you and your cloud provider's billing system.
• We have no access to your deployment. Your instance runs in your tenancy under your IAM; remote access for a support session exists only if you explicitly grant it, and you can revoke it at any time.
• External dependencies at deploy/runtime: None — the image is fully self-contained at deploy time; no internet access is required to boot and run.

Operate

• First boot: AWS: mysqld auto-initializes /var/lib/mysql on first start, then a one-shot unit (mysql-firstboot.service, marker /var/lib/mysql-firstboot.done) switches root to auth_socket and verifies it — seconds; the temporary password MySQL writes to /var/log/mysqld.log during initialization is invalidated in that same boot. GCE: the Ubuntu package initialized the data directory at image build with root already on auth_socket; only the server-uuid (auto.cnf) is regenerated on your first start. No credential is generated on either cloud.
• Update / patch: Prefer replacing the instance with the newest image version (monthly + event-driven CVE rebuilds). In place: `sudo dnf update mysql-community-server` (AWS) or `sudo apt upgrade mysql-server` (GCE) between refreshes. Major-version upgrades follow MySQL's documented path — take a backup first.
• Backup / restore: mysqldump --all-databases via `sudo mysql`, or stop mysqld and snapshot the volume. Restore: standard mysql import into a fresh instance.
• Uninstall: delete the VM/deployment and its volumes — nothing else persists, and software billing stops with the instance under your cloud's marketplace terms.
• Logs: AWS: /var/log/mysqld.log; `journalctl -u mysqld -f`. GCE: /var/log/mysql/error.log; `journalctl -u mysql -f`
• Health check: sudo mysql -e 'SELECT 1' (AWS: first boot is complete when /var/lib/mysql-firstboot.done exists; GCE: ready as soon as the mysql service is active)

Known limitations

Single-node; replication topology and remote exposure are deliberate customer decisions, not defaults.

Support

Email support@dcassociatesgroup.com — first response within 1 business day (US Eastern), most tickets same-day. To escalate an open ticket, reply "ESCALATE"; it is reviewed by the founder within 1 business day. Security reports: vulnerability disclosure.

Privacy: policy · Terms: terms · Security practices: security & trust · Vulnerability reports: disclosure policy