2026-08-26 · run 2026-08-26-mariadb-s4-and-toolchain

MariaDB: toolchain port + S4 confirmed identical to MySQL

Summary

MariaDB 11.4 (LTS) is the second non-Postgres engine. Three results:

The toolchain needed one more port. MariaDB renames the MySQL client tools — mariadb / mariadb-dump instead of mysql / mysqldump, with no compat symlinks in the image. snapshot.sh / restore.sh / index-audit.sh now pick the binary from the engine; the dump flag set also differs (MariaDB has no --set-gtid-purged / --no-tablespaces).
The migration is clean. 26.0.0 → 26.7.1 reaches ready, migration_model 26.7.1, and the index audit (engine mariadb) reports 121 correct / 0 missing / 0 wrong shape.
S4 carries over byte-for-byte from MySQL. A DML-only account fails the migration at Liquibase's own setup — ALTER command denied to user 'kc_dml' for table DATABASECHANGELOG [Failed SQL: (1142) ALTER TABLE keycloak.DATABASECHANGELOG ADD PRIMARY KEY (ID, AUTHOR, FILENAME)] — and granting the DDL set (CREATE, ALTER, DROP, INDEX, REFERENCES, CREATE VIEW, SHOW VIEW) makes it succeed. No ownership concept, same as MySQL.

Field	Value
Keycloak from → to	26.0.0 → 26.7.1
Database	MariaDB 11.4.13, single node, container `mariadb:11.4`
DB flags	`utf8mb4` / `utf8mb4_unicode_ci` (no invisible-PK flag — that is MySQL-only)
Cache	local (single node)
Dataset scale	200 users, 2 realms
Seeding method	`partialImport` (`seed-realm.sh --profile typical`)
Host	laptop (Docker 29)

Run	Account's rights	Outcome
smoke	`keycloak` (all on `keycloak.*`)	READY, audit 121/121
A	`kc_dml` DML only	exit 1 — `ALTER command denied ... DATABASECHANGELOG ADD PRIMARY KEY` (error 1142)
B	`kc_dml` DML + DDL	READY, audit 121/121

Claim	Evidence
Migration clean on MariaDB	`migration_model` 26.7.1, audit 121/121 ☑
DML-only fails, DDL suffices (no ownership)	run A 1142 vs run B READY ☑
Snapshot/restore round-trips on MariaDB	restore "no re-migration", users 200 ☑