无法通过MySQL Workbench连接Docker部署的MySQL容器求助

本地MySQL占用3306端口，部署MySQL容器时将宿主机3307端口映射到容器内3306端口，容器运行状态正常，但无法通过MySQL Workbench连接。已配置宽松防火墙规则、执行过用户授权操作，但使用user或root用户连接时均返回错误：

Access denied for user 'user'@'172.18.0.1' using password yes

其中172.18.0.1为Docker网桥地址，目前无排查思路，附上相关配置及日志信息：

docker-compose.yml #

version: '3.9'
services:
  db:
    image: mysql:8.3.0
    container_name: mysql-db
    environment:
      MYSQL_ROOT_PASSWORD: ${DB_PASSWORD}
      MYSQL_DATABASE: ${DB_NAME}
      MYSQL_USER: ${DB_USER}
      MYSQL_PASSWORD: ${DB_PASSWORD}
    ports:
      - ${DB_PORT}:3306
    expose:
      - 3307
    volumes:
      - db_data:/var/lib/mysql
volumes:
  db_data:

.env文件变量 #

NODE_ENV=development
DB_HOST=localhost
DB_USER=user
DB_PASSWORD=supersecret
DB_NAME=test_database
DB_PORT=3307

容器日志 #

mysql-db  | 2025-02-19 08:17:28+00:00 [Note] [Entrypoint]: Entrypoint script for MySQL Server 8.3.0-1.el8 started.
mysql-db  | 2025-02-19 08:17:28+00:00 [Note] [Entrypoint]: Switching to dedicated user 'mysql'
mysql-db  | 2025-02-19 08:17:28+00:00 [Note] [Entrypoint]: Entrypoint script for MySQL Server 8.3.0-1.el8 started.
mysql-db  | '/var/lib/mysql/mysql.sock' -> '/var/run/mysqld/mysqld.sock'
mysql-db  | 2025-02-19T08:17:28.637905Z 0 [System] [MY-015015] [Server] MySQL Server - start.
mysql-db  | 2025-02-19T08:17:28.847850Z 0 [System] [MY-010116] [Server] /usr/sbin/mysqld (mysqld 8.3.0) starting as process 1
mysql-db  | 2025-02-19T08:17:28.854518Z 1 [System] [MY-013576] [InnoDB] InnoDB initialization has started.
mysql-db  | 2025-02-19T08:17:28.982700Z 1 [System] [MY-013577] [InnoDB] InnoDB initialization has ended.
mysql-db  | 2025-02-19T08:17:29.138583Z 0 [Warning] [MY-010068] [Server] CA certificate ca.pem is self signed.
mysql-db  | 2025-02-19T08:17:29.138633Z 0 [System] [MY-013602] [Server] Channel mysql_main configured to support TLS. Encrypted connections are now supported for this channel.
mysql-db  | 2025-02-19T08:17:29.141681Z 0 [Warning] [MY-011810] [Server] Insecure configuration for --pid-file: Location '/var/run/mysqld' in the path is accessible to all OS users. Consider choosing a different directory.        
mysql-db  | 2025-02-19T08:17:29.162045Z 0 [System] [MY-011323] [Server] X Plugin ready for connections. Bind-address: '::' port: 33060, socket: /var/run/mysqld/mysqlx.sock
mysql-db  | 2025-02-19T08:17:29.162170Z 0 [System] [MY-010931] [Server] /usr/sbin/mysqld: ready for connections. Version: '8.3.0'  socket: '/var/run/mysqld/mysqld.sock'  port: 3306  MySQL Community Server - GPL.

docker ps输出 #

CONTAINER ID   IMAGE         COMMAND                  CREATED         STATUS         PORTS                                         NAMES
fda5732ca548   mysql:8.3.0   "docker-entrypoint.s…"   7 minutes ago   Up 7 minutes   3307/tcp, 33060/tcp, 0.0.0.0:3307->3306/tcp   mysql-db

netstat -ano | findstr :3307输出 #

TCP    0.0.0.0:3307           0.0.0.0:0              LISTENING       6884
  TCP    [::]:3307              [::]:0                 LISTENING       6884
  TCP    [::1]:3307             [::]:0                 LISTENING       8324

1. 修正用户权限范围
   MySQL默认创建的用户仅允许从容器内的localhost访问，而宿主机通过网桥连接的来源是172.18.0.1或任意外部地址。进入容器执行授权命令：

docker exec -it mysql-db mysql -uroot -psupersecret
# 执行SQL授权
GRANT ALL PRIVILEGES ON test_database.* TO 'user'@'%' IDENTIFIED BY 'supersecret';
GRANT ALL PRIVILEGES ON *.* TO 'root'@'%' IDENTIFIED BY 'supersecret';
FLUSH PRIVILEGES;

2. 移除无效配置
   docker-compose中的expose: -3307无意义（容器内MySQL运行在3306端口），删除该行后重启容器：

docker-compose down && docker-compose up -d

3. 检查Workbench连接配置

• 连接主机填写localhost或宿主机IP
• 端口填写3307
• 用户名填user或root，密码对应supersecret
• 关闭SSL选项（自签名证书可能导致连接失败）

4. 验证端口连通性
   使用telnet或nc测试端口是否可访问：

telnet localhost 3307
# 或
nc -zv localhost 3307

内容的提问来源于stack exchange，提问作者Fehu