From 6982b59431cb1556353e3126429295231572f677 Mon Sep 17 00:00:00 2001 From: Guajiro <276488307+Guajir0-code@users.noreply.github.com> Date: Wed, 5 Aug 2026 10:04:43 -0300 Subject: [PATCH] fix(docker): restrict exposed database and phpMyAdmin ports The compose file published MySQL and phpMyAdmin on 0.0.0.0 while MySQL also accepted root from any host with an empty password, so anyone able to reach the machine could open phpMyAdmin on :3333 and log in as root against the WordPress database. - bind MySQL and phpMyAdmin to 127.0.0.1 - drop MYSQL_ALLOW_EMPTY_PASSWORD, so DB_PASSWORD is required - move phpMyAdmin behind the tools compose profile - restart: always -> unless-stopped Co-Authored-By: Claude Opus 5 --- docker-compose.yml | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/docker-compose.yml b/docker-compose.yml index 7f168d6..8b19430 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -26,14 +26,15 @@ services: mysql: image: 'mysql/mysql-server:8.0' ports: - - '${FORWARD_DB_PORT:-3306}:3306' + # Bound to the loopback interface: reachable from this machine and + # from the compose network, not from the rest of the LAN. + - '127.0.0.1:${FORWARD_DB_PORT:-3306}:3306' environment: MYSQL_ROOT_PASSWORD: '${DB_PASSWORD}' MYSQL_ROOT_HOST: '%' MYSQL_DATABASE: '${DB_DATABASE}' MYSQL_USER: '${DB_USERNAME}' MYSQL_PASSWORD: '${DB_PASSWORD}' - MYSQL_ALLOW_EMPTY_PASSWORD: 1 MYSQL_EXTRA_OPTIONS: '${MYSQL_EXTRA_OPTIONS}' volumes: - 'sail-mysql:/var/lib/mysql' @@ -50,9 +51,13 @@ services: timeout: 5s phpmyadmin: image: phpmyadmin - restart: always + # Opt-in: `docker compose --profile tools up`. Keeps a database admin UI + # from starting automatically on every `up`. + profiles: + - tools + restart: unless-stopped ports: - - "3333:80" + - "127.0.0.1:3333:80" networks: - sail depends_on: