Install MySQL 8 from a Binary Tarball on Linux

A binary tarball installation gives you full control over the MySQL directory and version. Unlike a distribution package, it does not automatically create the system user, configure permissions, install a service, or apply security updates.

1. Download and verify the package

Choose the archive that matches your CPU architecture and glibc version from the official MySQL downloads page. The example filename below is illustrative:

wget https://dev.mysql.com/get/Downloads/MySQL-8.0/mysql-8.0.39-linux-glibc2.28-x86_64.tar.xz
sha256sum mysql-8.0.39-linux-glibc2.28-x86_64.tar.xz

Compare the checksum with the value published by MySQL. Install required runtime libraries through your operating system package manager.

2. Create a service account and directories

sudo groupadd --system mysql
sudo useradd --system --gid mysql --shell /usr/sbin/nologin mysql
sudo tar -xf mysql-8.0.39-linux-glibc2.28-x86_64.tar.xz -C /opt
sudo ln -s /opt/mysql-8.0.39-linux-glibc2.28-x86_64 /opt/mysql
sudo mkdir -p /var/lib/mysql /var/log/mysql /run/mysqld
sudo chown -R mysql:mysql /var/lib/mysql /var/log/mysql /run/mysqld

Keep program files owned by root and writable data directories owned by mysql.

3. Configure MySQL

Create /etc/my.cnf:

[mysqld]
basedir=/opt/mysql
datadir=/var/lib/mysql
socket=/run/mysqld/mysqld.sock
pid-file=/run/mysqld/mysqld.pid
log-error=/var/log/mysql/error.log
user=mysql
bind-address=127.0.0.1
character-set-server=utf8mb4

[client]
socket=/run/mysqld/mysqld.sock
default-character-set=utf8mb4

Binding to localhost is a safe default. If remote clients are required, use a private interface, firewall rules, TLS, and least-privilege database accounts.

4. Initialize the data directory

sudo -u mysql /opt/mysql/bin/mysqld   --defaults-file=/etc/my.cnf   --initialize
sudo grep 'temporary password' /var/log/mysql/error.log

Save the temporary password securely. Do not use --initialize-insecure on a production server.

5. Create a systemd unit

Create /etc/systemd/system/mysql.service:

[Unit]
Description=MySQL Server
After=network.target

[Service]
Type=notify
User=mysql
Group=mysql
ExecStart=/opt/mysql/bin/mysqld --defaults-file=/etc/my.cnf
TimeoutStartSec=90
Restart=on-failure
LimitNOFILE=65535
RuntimeDirectory=mysqld
RuntimeDirectoryMode=0755

[Install]
WantedBy=multi-user.target

Load and start it:

sudo systemctl daemon-reload
sudo systemctl enable --now mysql
sudo systemctl status mysql

6. Finish hardening

Connect with the temporary password and set a strong replacement, then run:

/opt/mysql/bin/mysql_secure_installation

Remove anonymous accounts and test databases, review root access, configure backups, and monitor disk capacity and replication if used. Add /opt/mysql/bin to a system-wide PATH only after confirming it cannot be modified by untrusted users.

Upgrades and rollback

Never replace the symlink and start a new MySQL binary without reading that release’s upgrade procedure. Take a tested backup, stop cleanly, preserve the old binaries, and rehearse the change on a copy of the data. Package-managed installations are usually easier to patch; use tarballs only when their control is worth the additional maintenance.