title: Best practice for MySQL passwords in Docker
body: <p>I am currently playing with docker containers and mysql databases. Each application has its own mysql db in its own docker container. The application and the database share a network, the application itself is accessed via another network (traefik). this means that the mysql database is not accessible from the outside. How important is it to set secure passwords for the mysql instances? is there a best practice?</p>
  
  <p><strong>Update</strong>: Using now Docker secrets</p>
  
  <p>Here is a sample <strong>docker-compose.yaml</strong> i use with nextcloud:</p>
  
  <pre><code>services: 
    nextcloud-db:
      image: mariadb
      container_name: nextcloud-db
      command: --transaction-isolation=READ-COMMITTED --log-bin=ROW
      restart: unless-stopped
      volumes:
        - /opt/docker/nextcloud/database:/var/lib/mysql
      environment:
        MYSQL_ROOT_PASSWORD_FILE: /run/secrets/mysql_root_password
        MYSQL_PASSWORD_FILE: /run/secrets/mysql_user_password
        MYSQL_DATABASE: nextcloud
        MYSQL_USER: nextcloud
        MYSQL_INITDB_SKIP_TZINFO: 1
      secrets:
        - mysql_root_password
        - mysql_user_password
  
  
  
  secrets:
    mysql_root_password:
      file: /opt/docker/secrets/mysql_root_password
    mysql_user_password:
      file: /opt/docker/secrets/mysql_user_password
  </code></pre>
  
  <p>You can create the secret files with:</p>
  
  <pre><code>openssl rand -base64 32 &gt; /opt/docker/secrets/mysql_root_password
  openssl rand -base64 32 &gt; /opt/docker/secrets/mysql_user_password
  </code></pre>