Running multiple MariaDB instances on one server

Why isolate the legacy database?

ISPConfig and current websites use the primary MariaDB service on port 3306. A legacy application may require permissive SQL behaviour that is inappropriate for the panel or every other website. A second service prevents a global configuration compromise.

Instance layout

Implemented pattern The legacy data service is intentionally not public. Applications connect through 127.0.0.1:3307 or its dedicated Unix socket.

ISPConfig limitation

Use ISPConfig for the normal service on port 3306. For the legacy service, connect explicitly to 127.0.0.1:3307. Do not use localhost unless its socket is explicitly configured, as it may select the primary instance instead.

Configuration of the second instance

Do not alter the primary instance’s global sql_mode. Create a separate configuration file with a different port, socket, PID file, data directory and log path.

[mariadbd]
port = 3307
bind-address = 127.0.0.1
socket = /run/mysqld/mariadb-charming.sock
pid-file = /run/mysqld/mariadb-charming.pid
datadir = /var/lib/mysql-charming
log-error = /var/log/mysql/mariadb-charming.err
sql_mode =

[client]
port = 3307
socket = /run/mysqld/mariadb-charming.sock

Initialize the dedicated data directory with the MariaDB utility appropriate to the installed version, owned by the mysql user. Keep the directory inaccessible to web users.

Run it as a separate systemd service

The second instance is started independently, allowing normal operations on the primary database without changing legacy behaviour.

[Unit]
Description=MariaDB legacy application instance
After=network.target

[Service]
Type=simple
User=mysql
Group=mysql
ExecStart=/usr/sbin/mariadbd --defaults-file=/etc/mysql/mariadb-charming.cnf
Restart=on-failure
PrivateTmp=true

[Install]
WantedBy=multi-user.target

systemctl daemon-reload
systemctl enable --now mariadb-charming.service
systemctl --no-pager status mariadb-charming.service
ss -lntp | grep 3307

Adapt hardening settings to the distribution’s packaged service conventions. Test service restarts and database recovery before relying on it in production.

Create dedicated users and grants

Create application accounts in the legacy instance only. Limit them to 127.0.0.1, grant only the necessary database privileges, and keep their passwords outside this document.

mariadb --protocol=TCP --host=127.0.0.1 --port=3307 -u root -p
CREATE DATABASE legacy_application CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
CREATE USER 'legacy_app'@'127.0.0.1' IDENTIFIED BY 'use-a-password-manager';
GRANT ALL PRIVILEGES ON legacy_application.* TO 'legacy_app'@'127.0.0.1';
FLUSH PRIVILEGES;

Set the application’s database host explicitly to 127.0.0.1 and its port to 3307. Using localhost can select a Unix socket and accidentally connect to the primary instance.

Add a clearly labelled phpMyAdmin connection

phpMyAdmin can offer a second server entry for the local legacy service. Label it clearly, use the loopback host and port 3307, and do not enable arbitrary remote hosts.

$cfg['Servers'][$i]['host'] = '127.0.0.1';
$cfg['Servers'][$i]['port'] = '3307';
$cfg['Servers'][$i]['verbose'] = 'Legacy MariaDB (3307)';
$cfg['Servers'][$i]['auth_type'] = 'cookie';

Use the configuration structure and local include path supplied by the installed phpMyAdmin package. Test both entries after package upgrades.

Backup, monitoring and acceptance checks

• Back up the two instances separately and verify restores to a non-production location.
• Monitor both systemd services, free disk space, error logs and backup completion.
• Confirm that port 3307 is loopback-only with ss -lntp.
• Confirm that the primary instance still has its original SQL-mode policy.
• Test the legacy application using its explicit host and port after every change.

mariadb --protocol=TCP -h 127.0.0.1 -P 3307 -e "SELECT @@port, @@sql_mode;"
mariadb -e "SELECT @@port, @@sql_mode;"
systemctl is-active mariadb mariadb-charming

The intended result is two independently operable services: a secure primary MariaDB for ISPConfig and ordinary sites, and a contained compatibility service for the legacy application.