Introduction

To connect from your host machine to MySQL running inside Docker, you need two things to be true at the same time: the MySQL port must be published to the host, and a MySQL user must be allowed to log in over that network path. Most failed connections happen because one of those two conditions is missing. Once you separate Docker networking from MySQL authentication, the setup becomes much easier to debug.

Publish the MySQL Port to the Host

The host cannot reach the database unless Docker maps a host port to the container’s port 3306.

1docker run --name my-mysql \
2  -e MYSQL_ROOT_PASSWORD=my-secret-pw \
3  -p 3306:3306 \
4  -d mysql:8

That -p 3306:3306 flag means:

• host port 3306
• forwarded to container port 3306

After the container starts, connect from the host with a normal MySQL client:

mysql -h 127.0.0.1 -P 3306 -u root -p

Using 127.0.0.1 is often clearer than localhost because it forces a TCP connection instead of any platform-specific local socket behavior.

Wait Until MySQL Is Actually Ready

A running container is not the same thing as a ready database. The MySQL image may still be initializing users, databases, or startup scripts.

docker logs my-mysql
docker ps
docker port my-mysql

If the client fails immediately after startup, check the logs first. MySQL often needs a short warm-up period before accepting connections.

Authentication Still Matters

Port publishing only gets traffic into the container. MySQL still decides whether the user may connect.

For local development, the root account may be enough, but a dedicated application user is better:

1CREATE DATABASE appdb;
2CREATE USER 'appuser'@'%' IDENTIFIED BY 'app-password';
3GRANT ALL PRIVILEGES ON appdb.* TO 'appuser'@'%';
4FLUSH PRIVILEGES;

The '%' host part allows network logins. That matters because a host-to-container connection is not the same thing as logging in locally inside the MySQL process.

If you see an access-denied error rather than a connection-refused error, Docker networking is probably fine and the problem is on the MySQL user side.

Handle Host Port Conflicts

If another database is already using host port 3306, publish MySQL to a different host port instead:

1docker run --name my-mysql \
2  -e MYSQL_ROOT_PASSWORD=my-secret-pw \
3  -p 3307:3306 \
4  -d mysql:8

Then connect with:

mysql -h 127.0.0.1 -P 3307 -u appuser -p

This is common on machines that already have a local MySQL instance installed outside Docker.

Docker Compose Example

Compose makes the port mapping and persistent storage easier to manage:

1services:
2  db:
3    image: mysql:8
4    environment:
5      MYSQL_ROOT_PASSWORD: my-secret-pw
6      MYSQL_DATABASE: appdb
7    ports:
8      - "3306:3306"
9    volumes:
10      - mysql-data:/var/lib/mysql
11
12volumes:
13  mysql-data:

The host connection details are still the same: 127.0.0.1, the published port, and a valid database user.

Host-to-Container Is Different From Container-to-Container

One common source of confusion is mixing host access with Docker-internal networking. From your laptop or workstation, use 127.0.0.1 and the published port. From another container on the same Docker network, use the MySQL service or container name instead.

Inside another container, localhost points back to that client container, not to the MySQL container.

Common Pitfalls

One common mistake is forgetting -p entirely. In that case, the database is healthy inside Docker but invisible from the host.

Another mistake is assuming any valid MySQL password is enough. If the user is not allowed to connect from the incoming host pattern, MySQL will reject the login even though the port is open.

Developers also often test too early, before MySQL finishes its initialization sequence. That produces misleading "cannot connect" errors during startup.

Finally, be careful when using the root account for everything. It works for quick experiments, but a dedicated application user gives you cleaner permissions and a more realistic setup.

Summary

• Publish MySQL to the host with -p host_port:3306.
• Connect from the host with 127.0.0.1 and the published port.
• Check container logs because MySQL may not be ready immediately after startup.
• Docker networking and MySQL authentication are separate layers that can fail independently.
• Prefer a dedicated database user instead of relying on root for normal application access.