I have a MariaDB container running on my swarm cluster that services several applications, each running in their own container and connected to the database with a dedicated network (internal and attachable). All the communication between the containers works fine and I am able to make database connections successfully from the application containers, as long as the the grants for that user is set to the wildcard (ie.'user'@'%').
My problem lies with limiting access to the various databases hosted in the container using GRANT statements as we would normally do in a non-containerized environment. The containers can ping/telnet to one another using the network aliases defined in their service configuration. When connecting to the database, the remote hostname is seen by MariaDB as the IP of the network's "endpoint", not the ip or hostname of the container initiating the connection (nor the container's network endpoint). This makes it impossible to setup a grant statement that limits access to a given database or table by the typical user@host credentials. I haven't been able to specify the network endpoint as it does not exist until containers attach to the network.
Is there some workaround for this issue that others have found? Ideally we would be able to limit access based on the container's hostname or network alias but I'm open to other approaches.