Add ability to change host value for root user to secure container

[yosifkit]

Now you can easily remove remote MySQL root access or secure to a specific IP address (DNS name would require custom cnf to override the provided config files). root@localhost will always work regardless of this new value.

$ docker run -d --name mysql -e MYSQL_ROOT_PASSWORD=pass -e MYSQL_ROOT_HOST=localhost -e MYSQL_DATABASE=db -e MYSQL_USER=user -e MYSQL_PASSWORD=pass2 mysql:5.6
$ docker run -it --rm --link mysql mysql:5.7 mysql -hmysql -uroot -ppass
mysql: [Warning] Using a password on the command line interface can be insecure.
ERROR 1045 (28000): Access denied for user 'root'@'172.17.0.5' (using password: YES)
$ docker run -it --rm --link mysql mysql:5.7 mysql -hmysql -uuser -ppass2 db
mysql: [Warning] Using a password on the command line interface can be insecure.
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 12
Server version: 5.6.35 MySQL Community Server (GPL)

Copyright (c) 2000, 2016, Oracle and/or its affiliates. All rights reserved.

Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

mysql> ^DBye

fixes #231

Borrows heavily from mysql@6fbb227

[tianon]

This is going to cause issues with file_env (-e MYSQL_ROOT_HOST_FILE=... will lead to error: both MYSQL_ROOT_HOST and MYSQL_ROOT_HOST_FILE are set (but are exclusive)), so needs to be specified as the default in the script instead (via the second argument to file_env).

[yosifkit]

Updated to work properly with MYSQL_ROOT_HOST_FILE; cannot use an empty value to remove the root@% user, you must use localhost or MYSQL_ROOT_HOST_FILE=/dev/null or another empty file.

[yosifkit]

Should this check also look for loopback IP addresses like 127.0.0.1 or ::1?

[yosifkit]

Found the answer: No; localhost for mysql is just the unix socket, so IP addresses do not factor in to it.

[yosifkit]

cc @ltangvald

[ltangvald]

Looks good.