1

I can't figure this one out. Below is my docker compose file. This is a docker swarm but all on a single host (just testing the setup). I'm trying to add an app user to mysql so the web container can access the db container's mysql server. I do not want to use a generic host wildcard as the db container's mysql port will be open to the world. Is there any way to do this automatically? I've tried using 'web' for the host but I always get an access denied from '10.0.0.x' error.

Thanks!

update sql:

UPDATE mysql.user SET host = 'web' where user = 'app';
FLUSH PRIVILEGES;

Connect error:

Access denied for user 'app'@'10.0.1.4' (using password: YES)

docker-compose:

version: "3.4"
services: 
    web:
        image: app:latest
        ports: 
            - 4000:80
        # networks: 
            # - appnet
        volumes:
            - uploads:/app/uploads
        secrets:
            - dbapp
            - mailkey
            - sessionsecret
        deploy:
            replicas: 1
            restart_policy:
                condition: on-failure
                delay: 1s
                max_attempts: 10
    redis:
        image: redis:alpine
        # networks:
            # - appnet
    db:
        image: mysql:5.7
        # networks:
            # - appnet
        secrets:
            - dbroot
            - dbapp
        environment:
            MYSQL_DATABASE: "app"
            MYSQL_USER: "app"
            MYSQL_ROOT_PASSWORD_FILE: /run/secrets/dbroot
            MYSQL_PASSWORD_FILE: /run/secrets/dbapp
        volumes:
            - db:/var/lib/mysql
            - ./scripts:/docker-entrypoint-initdb.d
secrets:
    dbroot:
        external: true
    dbapp:
        external: true
    sessionsecret:
        external: true
    mailkey:
        external: true
volumes:
    uploads:
    db:
# networks: 
    # - appnet
ktravelet
  • 101
  • 1
  • 9
  • Ideally you wouldn't open the db port to the public, but if you have to, you could still allow a wildcard on the LAN like '10.0.1.%' or similar - you would need to check the IP block in production. See https://stackoverflow.com/questions/11742963/how-to-grant-remote-access-to-mysql-for-a-whole-subnet – ldg Apr 12 '18 at 16:26
  • In this example compose file the db is only available on the swarm network you used for your stack. db will not be avail outside server, so no need to lock down IP subnets. – Bret Fisher Apr 14 '18 at 02:14

0 Answers0