From 7d7141c055632ad9b9b3045b7edbaf4e04647190 Mon Sep 17 00:00:00 2001
From: yml2213 <a2213290201@gmail.com>
Date: Sun, 16 Aug 2026 23:34:53 +0800
Subject: [PATCH] =?UTF-8?q?=E4=BF=AE=E5=A4=8DXtraBackup=E6=95=B0=E6=8D=AE?=
 =?UTF-8?q?=E5=8D=B7=E6=9D=83=E9=99=90?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 scripts/backup-online.sh | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/scripts/backup-online.sh b/scripts/backup-online.sh
index d059599..0925664 100755
--- a/scripts/backup-online.sh
+++ b/scripts/backup-online.sh
@@ -71,12 +71,12 @@ user=${backup_user}
 password=${backup_password}
 host=mysql
 EOF
-  # XtraBackup 镜像可能以非 root 用户运行；临时目录受 umask 077 保护，
-  # 因此配置文件需要对容器内用户可读，但不会暴露给宿主机其他用户。
-  chmod 644 "${tmp_dir}/xtrabackup-client.cnf"
+  chmod 600 "${tmp_dir}/xtrabackup-client.cnf"
 
   backup_log "开始全量热备，实例 ${server_uuid}"
-  docker run --rm \
+  # MySQL 数据卷中的 redo 文件仅 MySQL 用户和 root 可读。以 root 运行备份
+  # 容器读取数据，同时保留宿主机业务用户的组，保证后续本地打包可读取备份文件。
+  docker run --rm --user "0:$(id -g)" \
     --network "${network}" \
     --volumes-from "${mysql_cid}:ro" \
     -v "${tmp_dir}/xtrabackup:/backup" \