Docker IP changes makes locking down MySQL access tricky - mysql

Question

I'm trying to lock down access to a MySQL user account to one IP address, but it seems that every time you start a docker container, the IP address changes.
docker run -it company/my-app bash
Setup mysql-client on it
apt-get update
apt-get upgrade
apt-get install mysql-client
Now I would connect using:
mysql -u blah -h database.host.com -p
Access denied for user 'blah'#'172.17.0.63' (using password: YES)
Then I would grant all privileges for blah'#'172.17.0.63 and I'd be able to access the database from the container. Now I would start a new docker container and repeat the above steps and I would once again get:
Access denied for user 'blah'#'172.17.0.64' (using password: YES)
The IP address seems to increment every time you start a docker container.
I can limit the hosts to %.%.%.%, but that just means any IP address can connect which is not as secure as I want it.
Is there some sort of way to limit access to a mysql account to only one docker container or group of containers?

Answer 1

You can configure a small dnsmasq instance to be used by MySQL, and run a script to automatically update the DNS record when the container's IP address has changed.
I've written a small script to do this (pasted below), which automatically update DNS record which has the same name as the containers' name and points them to the containers' IP addresses:
#!/bin/bash
# 10 seconds interval time by default
INTERVAL=${INTERVAL:-10}
# dnsmasq config directory
DNSMASQ_CONFIG=${DNSMASQ_CONFIG:-.}
# commands used in this script
DOCKER=${DOCKER:-docker}
SLEEP=${SLEEP:-sleep}
TAIL=${TAIL:-tail}
declare -A service_map
while true
do
changed=false
while read line
do
name=${line##* }
ip=$(${DOCKER} inspect --format '{{.NetworkSettings.IPAddress}}' $name)
if [ -z ${service_map[$name]} ] || [ ${service_map[$name]} != $ip ] # IP addr changed
then
service_map[$name]=$ip
# write to file
echo $name has a new IP Address $ip >&2
echo "host-record=$name,$ip" > "${DNSMASQ_CONFIG}/docker-$name"
changed=true
fi
done < <(${DOCKER} ps | ${TAIL} -n +2)
# a change of IP address occured, restart dnsmasq
if [ $changed = true ]
then
systemctl restart dnsmasq
fi
${SLEEP} $INTERVAL
done
Then, create your MySQL user with the host equal to the container's name, e.g. your container's name is blah then you create MySQL user as 'you'#'blah'.

Answer 2

I think your current approach is wrong. You can simply use the official MySQL container and link to it the cointainers you want to have access:
docker run --name some-app --link some-mysql:mysql -d app-that-uses-mysql
This will add an entry to the some-app /etc/hosts file with the name "mysql" pointing to the MySQL container, as described in the docker linking docs.