diff --git a/pica-etherpad-db/Dockerfile b/pica-etherpad-db/Dockerfile
new file mode 100644
index 0000000000000000000000000000000000000000..1340201bd068574ef51ed01f1efe83a412874d57
--- /dev/null
+++ b/pica-etherpad-db/Dockerfile
@@ -0,0 +1,3 @@
+FROM mysql:8
+
+COPY config/limit_binary_log.cnf /etc/mysql/conf.d/limit_binary_log.cnf
diff --git a/pica-etherpad-db/README.md b/pica-etherpad-db/README.md
new file mode 100644
index 0000000000000000000000000000000000000000..26924f2314171a923ce385d8b029c0c9801d00ed
--- /dev/null
+++ b/pica-etherpad-db/README.md
@@ -0,0 +1 @@
+This image limits the [mysql binary log](https://dev.mysql.com/doc/refman/8.0/en/binary-log.html) to 30 hours (=108000 seconds) via the [binlog_expire_logs_seconds](https://dev.mysql.com/doc/refman/8.0/en/replication-options-binary-log.html#sysvar_binlog_expire_logs_seconds) variable.
diff --git a/pica-etherpad-db/clair-whitelist.yml b/pica-etherpad-db/clair-whitelist.yml
new file mode 100644
index 0000000000000000000000000000000000000000..a9d6ed5bdae04856ade1de9572cbdfee041aa4b9
--- /dev/null
+++ b/pica-etherpad-db/clair-whitelist.yml
@@ -0,0 +1 @@
+generalwhitelist:
diff --git a/pica-etherpad-db/config/limit_binary_log.cnf b/pica-etherpad-db/config/limit_binary_log.cnf
new file mode 100644
index 0000000000000000000000000000000000000000..522abe9317483ccffc03740b111d9c2977da140f
--- /dev/null
+++ b/pica-etherpad-db/config/limit_binary_log.cnf
@@ -0,0 +1,2 @@
+[mysqld]
+binlog_expire_logs_seconds = 108000