Deploying MySQL on Linux with Docker • MYSQL_RANDOM_ROOT_PASSWORD : When this variable is true (which is its default state, unless MYSQL_ROOT_PASSWORD  is set or  MYSQL_ALLOW_EMPTY_PASSWORD  is set to true), a random password for the server’s root user is generated when the Docker container is started. The password is printed to  stdout  of the container and can be found by looking at the container’s log (see  Starting a MySQL Server Instance). • MYSQL_ONETIME_PASSWORD : When the variable is true (which is its default state, unless MYSQL_ROOT_PASSWORD  is set or  MYSQL_ALLOW_EMPTY_PASSWORD  is set to true), the root user’s password is set as expired and must be changed before MySQL can be used normally. • MYSQL_DATABASE : This variable allows you to specify the name of a database to be created on image startup. If a user name and a password are supplied with  MYSQL_USER  and  MYSQL_PASSWORD , the user is created and granted superuser access to this database (corresponding to  GRANT ALL ). The specified database is created by a CREATE DATABASE IF NOT EXIST statement, so that the variable has no effect if the database already exists. • MYSQL_USER ,  MYSQL_PASSWORD : These variables are used in conjunction to create a user and set that user’s password, and the user is granted superuser permissions for the database specified by the  MYSQL_DATABASE  variable. Both  MYSQL_USER  and  MYSQL_PASSWORD  are required for a user to be created—if any of the two variables is not set, the other is ignored. If both variables are set but MYSQL_DATABASE  is not, the user is created without any privileges. • MYSQL_ROOT_HOST : By default, MySQL creates the  ’root’@’localhost’  account. This account can only be connected to from inside the container as described in Connecting to MySQL Server from within the Container. To allow root connections from other hosts, set this environment variable. For example, the value  172.17.0.1 , which is the default Docker gateway IP, allows connections from the host machine that runs the container. The option accepts only one entry, but wildcards are allowed (for example,  MYSQL_ROOT_HOST=172.*.*.*  or  MYSQL_ROOT_HOST=% ). • MYSQL_LOG_CONSOLE : When the variable is true (which is its default state for MySQL 8.0 server containers), the MySQL Server’s error log is redirected to  stderr , so that the error log goes into the Docker container’s log and is viewable using the  docker logs  mysqld-container  command. • MYSQL_ROOT_PASSWORD : This variable specifies a password that is set for the MySQL root account. Note Warning The variable has no effect if a server configuration file from the host has been mounted (see Persisting Data and Configuration Changes on bind-mounting a configuration file). Setting the MySQL root user password on the command line is insecure. As an alternative to specifying the password explicitly, you can set the variable with a container file path for a password file, and then mount a file from your host that contains the password at the container file path. This is still not very secure, as the location of the password file is still exposed. It is preferable to use the default 193 Note There is no need to use this mechanism to create the root superuser, which is created by default with the password set by either one of the mechanisms discussed in the descriptions for  MYSQL_ROOT_PASSWORD  and MYSQL_RANDOM_ROOT_PASSWORD , unless  MYSQL_ALLOW_EMPTY_PASSWORD  is true.