How to setup secure docker hosted MySQL DB for use by multiple apps?

  • Posted on February 18, 2015
  • vitacodeAsked by vitacode

Currently I have a MySQL DB running on the same VPS as my web server. For scalability purposes, and to allow my other apps to access the MySQL DB, I would like to move the DB to it’s own server. Ideally I would like to use CoreOS to host a MySQL docker image to also run some other small dockerized services on the same VPS.

What I’m unsure about is how to ensure secure connections between my web apps and the DB? i.e. encrypted connections. Should I:

  • configure SSL in MySQL?
  • create SSH tunnels from the web apps to the MySQL server?
    • I assume in this case I would only have an SSH port open on the VPS firewall.

It would also be great to use private networking (I know that this doesn’t secure the connections) to keep host to host communications free.

Submit an answer

This textbox defaults to using Markdown to format your answer.

You can type !ref in this text area to quickly search our full set of tutorials, documentation & marketplace offerings and insert the link!

Sign In or Sign Up to Answer

These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.

Want to learn more? Join the DigitalOcean Community!

Join our DigitalOcean community of over a million developers for free! Get help and share knowledge in Q&A, subscribe to topics of interest, and get courses and tools that will help you grow as a developer and scale your project or business.


The method I would recommend is an SSH tunnel over to the host machine running the docker container. This is because it’s the more secure route than opening the docker port to the public. Generally I try to avoid opening MySQL to a public interface unless absolutely needed.

Using private networking isn’t an issue, so long as the droplets are in the same data center. This would provide a quicker response time than going over the public interface.

How you do this can vary based on your setup and what you plan to connect with. You will likely need to expose the port on the MySQL docker container with the added to your docker create or an EXPOSE directive if you use a docker file

Using docker run:

docker run --name my-container-name --expose=3306 -e MYSQL_ROOT_PASSWORD=my-secret-pw -d mysql/mysql-server:latest

When adding to your dockerfile:




This will ensure the docker container is exposing the MySQL port to the host environment, making it accessible when you connect through your SSH tunnel.