0

I have a MariaDB container running on my swarm cluster that services several applications, each running in their own container and connected to the database with a dedicated network (internal and attachable). All the communication between the containers works fine and I am able to make database connections successfully from the application containers, as long as the the grants for that user is set to the wildcard (ie.'user'@'%').

My problem lies with limiting access to the various databases hosted in the container using GRANT statements as we would normally do in a non-containerized environment. The containers can ping/telnet to one another using the network aliases defined in their service configuration. When connecting to the database, the remote hostname is seen by MariaDB as the IP of the network's "endpoint", not the ip or hostname of the container initiating the connection (nor the container's network endpoint). This makes it impossible to setup a grant statement that limits access to a given database or table by the typical user@host credentials. I haven't been able to specify the network endpoint as it does not exist until containers attach to the network.

Is there some workaround for this issue that others have found? Ideally we would be able to limit access based on the container's hostname or network alias but I'm open to other approaches.

Improve this question
2
  • Out of curiosity, have you tried to set up the grants using the container hostname? It's unclear if you tried this and failed, or if you assumed it would fail because of how MariaDB is "seeing" your clients. – t3ddftw Nov 12 '19 at 19:47
  • @t3ddftw Yes, I've actually tried using the container hostname in the grants and it failed. Digging into that failure is how I discovered that the network endpoint's address was being reported as the remote host instead of the container name or address. – AntEater Nov 13 '19 at 15:07
1

First make sure that you have name service resolution operational with docker swarm (never used swarm, but this kind of service is proposed with any decent orchestrator like k8s, opensvc, ...). This is needed by mariadb to do a reverse dns lookup of client connecting to the database.

Second make sure that you do not have skip-name-resolve parameter enabled in your mariadb config.

Once done, 'user@fqdn' grants should be honored by mariadb

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.