MySQL "Host ... is not allowed to connect to this MySQL server" in CI

MySQL accounts are scoped to a host (user@host). The connection arrives from a container IP that has no matching grant, so the server rejects it before checking the password. Grant the user on % or connect as a user that can.

What this error means

Connecting from your app container fails with "Host \"172.18.0.1\" is not allowed to connect to this MySQL server", even though the credentials are correct.

Terminal

ERROR 1130 (HY000): Host '172.18.0.1' is not allowed to connect to this MySQL server

Common causes

The user account is bound to a specific host

A user created as app@localhost cannot be used from another container, whose source IP differs. MySQL matches user@host and finds no grant.

A custom MYSQL_USER created with a narrow host

If you create the user yourself with a literal host, connections from the runner network are not covered.

How to fix it

Let the image create the user (host %)

The official image creates MYSQL_USER with host %, which accepts any host. Use those env vars instead of a hand-rolled CREATE USER.

.github/workflows/ci.yml

services:
  mysql:
    image: mysql:8.0
    env:
      MYSQL_ROOT_PASSWORD: root
      MYSQL_DATABASE: app_test
      MYSQL_USER: app
      MYSQL_PASSWORD: app_pw
    ports: ['3306:3306']

Grant the user on any host

If you must create the user manually, grant it on % so connections from any container IP are accepted.

SQL

CREATE USER 'app'@'%' IDENTIFIED BY 'app_pw';
GRANT ALL ON app_test.* TO 'app'@'%';

How to prevent it

Prefer MYSQL_USER/MYSQL_PASSWORD env vars; the image grants on %.
Avoid @localhost accounts when connecting across containers.
Connect via TCP to the mapped port so host matching is predictable.