The safest default for several containerized applications is one MySQL service on a private, user-defined Docker network, with a named volume mounted at /var/lib/mysql. Each application connects to the service name (such as db) on port 3306; you publish port 3306 on the host only when an outside client genuinely needs it.
Antihost offers VPS plans with one-click Docker, NVMe storage and a 14-day free trial.
Give every application its own database and non-root MySQL account. Keep passwords in Compose secrets, use the MySQL image’s _FILE variables where supported, run versioned migrations after first initialization, and maintain tested backups outside the database container.
As an Amazon Associate I earn from qualifying purchases.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWhat the finished setup looks like
The architecture has four boundaries:
- A single MySQL 8.4 service named
db. - A named volume mounted at
/var/lib/mysql, so replacing the container does not remove database files. - A private Docker network shared only by MySQL and the application containers that need it.
- Separate database names, users and passwords for each application, with no application using the root account.
Containers on the same Compose network resolve one another by service name. An application therefore uses DB_HOST=db and DB_PORT=3306; it does not use localhost, because localhost inside an application container refers to that application container itself. Host port publishing is optional in this design.
Choose one MySQL service or several
| Consideration | One shared MySQL service | Separate MySQL services |
|---|---|---|
| Isolation | Logical isolation through databases and users; all applications share one server process. | Stronger process and configuration isolation, with a separate server for each application. |
| Operational overhead | One image, upgrade path, health check and backup job to operate. | Each instance needs its own configuration, upgrades, monitoring and backup handling. |
| Backup scope | A server-level backup can contain every application; logical dumps can still be selected by database. | Backups are naturally separated, but the number of jobs and restore procedures increases. |
| Resource use | Usually lower memory and CPU overhead because one server is shared. | Higher baseline resource use from multiple server processes and caches. |
| Failure blast radius | A MySQL outage or bad server-wide change affects every application. | An instance failure normally affects only its application. |
| Migration complexity | One server upgrade, but schema migrations must remain independent per database. | More upgrade work, but application-specific server settings are easier to vary. |
Use one service when the applications can share a MySQL version and an outage boundary is acceptable. Use separate instances when regulatory isolation, conflicting server settings or independent availability requirements outweigh the additional operations work.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
Prepare the project and secret files
Keep the Compose project, secret files and initialization scripts in a controlled directory. The following layout keeps credentials out of the Compose YAML:
project/
compose.yml
secrets/
db_root_password.txt
app1_password.txt
app2_password.txt
initdb/
01-create-app2.sh- Create the directories with
mkdir -p project/secrets project/initdb. - Generate long, random passwords with an approved password generator. Do not reuse an application password as the root password.
- Write one password per file, without committing the files to source control. Restrict access, for example with
chmod 600 project/secrets/*.txt. - Add the secret directory to
.gitignoreand check that no image build context, log collector or backup archive is accidentally including it.
Compose secrets are mounted as files under /run/secrets/<secret_name> and are granted only to services listed in their secrets attribute. Docker defines a secret as data such as a password, certificate or API key that should not be transmitted over a network or stored unencrypted in a Dockerfile or application source. Environment variables can be exposed to processes or logs, so use them only for non-sensitive connection metadata unless the application specifically requires another mechanism.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesCompose configuration for the database and two apps
This example uses the mysql:8.4 image, a private network and a named volume. Adjust the image tag and the application images to the versions you actually deploy.
services:
db:
image: mysql:8.4
restart: unless-stopped
volumes:
- mysql_data:/var/lib/mysql
- ./initdb:/docker-entrypoint-initdb.d:ro
secrets:
- db_root_password
- app1_password
- app2_password
environment:
MYSQL_ROOT_PASSWORD_FILE: /run/secrets/db_root_password
MYSQL_DATABASE: app1
MYSQL_USER: app1
MYSQL_PASSWORD_FILE: /run/secrets/app1_password
healthcheck:
test: ["CMD-SHELL", "mysqladmin ping -h 127.0.0.1 -u root -p"$$(cat /run/secrets/db_root_password)" --silent"]
interval: 10s
timeout: 5s
retries: 12
start_period: 30s
networks: [backend]
app1:
image: your-app1-image
environment:
DB_HOST: db
DB_PORT: 3306
DB_NAME: app1
DB_USER: app1
DB_PASSWORD_FILE: /run/secrets/app1_password
secrets: [app1_password]
depends_on:
db:
condition: service_healthy
networks: [backend]
app2:
image: your-app2-image
environment:
DB_HOST: db
DB_PORT: 3306
DB_NAME: app2
DB_USER: app2
DB_PASSWORD_FILE: /run/secrets/app2_password
secrets: [app2_password]
depends_on:
db:
condition: service_healthy
networks: [backend]
volumes:
mysql_data:
networks:
backend:
internal: true
secrets:
db_root_password:
file: ./secrets/db_root_password.txt
app1_password:
file: ./secrets/app1_password.txt
app2_password:
file: ./secrets/app2_password.txtThe MySQL image’s MYSQL_ROOT_PASSWORD_FILE and MYSQL_PASSWORD_FILE variables read the mounted files during first-time initialization. The application images must themselves support DB_PASSWORD_FILE; if they do not, change their entrypoint to read the file and pass the value to the framework without printing it.
The internal: true network prevents ordinary external access to the database network. If an application needs internet access, attach that application to a second, non-internal network while leaving MySQL only on backend.
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
Create the second database and user safely
MYSQL_DATABASE, MYSQL_USER and MYSQL_PASSWORD_FILE create the initial application database and account, so the example creates app1. Those variables do not automatically create every later application. Create app2 with a one-time initialization script that reads its secret file and issues SQL through the local MySQL socket:
#!/bin/sh
set -eu
app2_password=$$(cat /run/secrets/app2_password)
mysql --protocol=socket -uroot -p"$$(cat /run/secrets/db_root_password)" <<-SQL
CREATE DATABASE IF NOT EXISTS app2;
CREATE USER IF NOT EXISTS 'app2'@'%' IDENTIFIED BY '$$app2_password';
ALTER USER 'app2'@'%' IDENTIFIED BY '$$app2_password';
GRANT ALL PRIVILEGES ON app2.* TO 'app2'@'%';
FLUSH PRIVILEGES;
SQLMake the script executable with chmod 700 project/initdb/01-create-app2.sh. The script is an example pattern: validate the password characters and quoting rules required by your deployment, and prefer a dedicated migration or provisioning process if your organization already has one.
GRANT ALL ON app2.* limits the account to the app2 database, but it still grants broad rights within that database. If the application does not need schema changes in production, use explicit grants such as SELECT, INSERT, UPDATE, DELETE and the narrowly required execution privileges, then run DDL through a separate migration account. Never put the root password in an application connection string.
Start the stack and verify connectivity
- From the project directory, run
docker compose config. Check that the rendered configuration contains the expected services, networks, volume and secret references, but no password literals. - Start the services with
docker compose up -d. - Watch initialization with
docker compose logs -f db. The first start can take time while the data directory and system tables are created. - Confirm health with
docker compose ps. The database should eventually show a healthy status. - Check name resolution from an application container with
docker compose exec app1 getent hosts db, if that diagnostic utility exists in the image. - Test the application’s own connection path. It should use host
db, port3306, databaseapp1orapp2, and the matching non-root account.
A healthy container is not a guarantee that every application is ready to query. Compose can start services at nearly the same time, and MySQL may still be completing initialization. Keep framework-level connection retries and exponential backoff even when you use depends_on with a health condition.
Decide whether to publish port 3306
Do not add a ports entry for normal app-to-database traffic. On the private network, applications reach MySQL directly by service name. Publishing 3306:3306 exposes a host listener and increases the number of places that must be protected by firewalls, authentication and monitoring.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
Publish the port only for a defined requirement, such as a host-based migration job or an external administration client. If you must publish it:
- Bind to a restricted host address rather than all interfaces when possible.
- Allow only approved source addresses in the host firewall.
- Use TLS and individual accounts for clients that connect across an untrusted network.
- Remove the mapping after the maintenance task instead of leaving it permanently enabled.
For routine administration, a deliberately protected administration container on the same private network avoids exposing MySQL to the host at all. Give that tool a separate account and do not reuse application credentials.
Understand first initialization and schema changes
Scripts in /docker-entrypoint-initdb.d/ run after a fresh data directory is created. They are skipped when the mounted /var/lib/mysql directory already contains a database. Likewise, changing MYSQL_DATABASE, MYSQL_USER or a password-file value later does not rewrite an existing database or change an existing user’s password.
This behavior protects existing data but surprises operators who expect an edited Compose file to apply automatically. Treat the initialization directory as bootstrap code only. Store ongoing schema changes in versioned migrations, run them through a controlled deployment step, and record which migration version each application database has reached.
Recommended Free Tools
To deliberately rebuild a disposable development database, stop the project and remove its named volume only after confirming that its contents are not needed. Never use volume removal as a production password-rotation or migration technique.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
Persist and protect the data volume
A named volume keeps MySQL files outside the container’s writable layer and survives container removal and replacement. The database files remain available when you pull a new image or recreate the service, provided you keep the volume and mount it at exactly /var/lib/mysql.
| Storage choice | Advantages | Trade-offs |
|---|---|---|
| Named volume | Portable across container recreation, managed by Docker, and less dependent on host directory ownership. | Requires deliberate procedures to locate, back up and move the volume between hosts. |
| Managed bind mount | Direct host control over the path, filesystem tools and many existing backup systems. | Host permissions, SELinux or AppArmor policy, filesystem layout and accidental edits become your responsibility. |
Do not edit files inside the MySQL data directory while the server is running. Protect the Docker host, restrict who can access the volume, monitor free space and document where the volume is stored. Persistence is not a backup: a corrupted database, operator error or host failure can still destroy the only copy.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Back up and restore outside the container
Schedule logical backups with mysqldump or an equivalent MySQL backup workflow outside the database container. A simple logical dump can be streamed to a host file without creating a backup file in the container:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
docker compose exec -T db sh -c 'mysqldump --single-transaction --routines --triggers -uroot -p"$$(cat /run/secrets/db_root_password)" --all-databases' > backups/mysql-$$(date +%F).sqlStore the resulting file on durable storage separate from the Docker host, protect it as sensitive data, and apply a retention policy. Test restoration on an isolated MySQL instance, not merely the creation of a dump. A restore exercise should verify that databases, users, grants, routines and application migrations produce a working application.
The documentation for MySQL describes logical dumps and enterprise backup and restore workflows, but it does not prescribe a universal recovery-time objective or recovery-point objective. Set those targets per application, then choose backup frequency, retention and replication accordingly.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
Manage password rotation
Replacing a secret file does not change the password already stored in MySQL. Rotate an account deliberately:
- Create a new secret value and distribute it to the approved secret store or file with restrictive permissions.
- Run
ALTER USER 'app1'@'%' IDENTIFIED BY 'new-value';through a protected administrative path. - Update the application’s mounted secret and restart or reload the application so its connection pool uses the new value.
- Verify new connections and revoke any old credential according to your overlap plan.
- Remove temporary copies and check logs for accidental disclosure.
For high-availability applications, use a short overlap with two accounts or a coordinated rollout rather than changing a password while every process still holds pooled connections.
Free tools Windows power users keep installed
One-click scans. No signup required.
Compose secrets versus an external secrets manager
| Factor | Compose file secrets | External secrets manager |
|---|---|---|
| Deployment scope | Convenient for a single host or a small, controlled Compose deployment. | Centralized across hosts, environments and orchestration systems. |
| Rotation | Requires changing the source file and coordinating service updates; MySQL accounts still need an explicit password change. | Usually supports centralized rotation workflows, but applications must support retrieval or injected updates. |
| Auditability | Filesystem and deployment logs provide limited history unless you add controls. | Typically offers access policies and audit records, depending on the product and configuration. |
| Operational complexity | Low initial complexity, with responsibility for file permissions, host protection and distribution. | More setup, authentication and availability dependencies, but stronger centralized governance. |
Compose secrets improve on committed plaintext credentials, but they are not a substitute for host security or encrypted backup handling. Choose an external manager when multiple operators, environments, hosts or mandatory rotation and audit requirements justify its operational cost.
Troubleshoot the common failures
The application reports “connection refused”
Check that the application uses db, not localhost, and port 3306, not a host-mapped port. Inspect docker compose ps and database logs, then confirm the application retries while MySQL is initializing. A missing shared network or a misspelled service name prevents DNS resolution.
The application reports “access denied”
Verify the database name, username and mounted secret belong to the same application. Remember that changing MYSQL_PASSWORD_FILE after first initialization does not alter an existing account. Run an explicit ALTER USER operation and restart the application’s connection pool.
A new database was not created
Inspect whether /var/lib/mysql already contained data. Initialization scripts and MYSQL_* bootstrap variables apply only to an empty data directory. Create the database and account through a controlled migration or provisioning command instead of deleting a volume that contains production data.
The database disappeared after recreation
Check the service’s volume declaration and confirm that the same named volume is mounted at /var/lib/mysql. A container writable layer is not durable storage. Do not run docker compose down -v unless removing the volume is intentional and backed by a verified backup.
An external client cannot connect
That is expected when no host port is published or the network is internal. Decide whether external access is truly required; if so, publish and firewall the port deliberately, use TLS and a least-privilege account, and remove the exposure when the task ends.
Quick Recap
Production readiness decisions
- Pin and review the MySQL image version used by the deployment; test upgrades against a restored backup.
- Keep MySQL on a private network and publish 3306 only for a documented need.
- Use one database and one non-root credential set per application.
- Grant only the privileges the application and its migration process require.
- Keep secrets out of Git, Dockerfiles, image layers and routine logs.
- Use a named volume or a managed bind mount at
/var/lib/mysql. - Use health checks plus application-level retry and backoff.
- Treat entrypoint scripts as first-boot bootstrap and use versioned migrations afterward.
- Back up to durable storage and perform restoration exercises on a schedule.
- Document password rotation, volume recovery, restore commands and the owner for each application database.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
