MYSQL show user permission and user@host

 MYSQL cmds to show user privileges

SELECT CONCAT('SHOW GRANTS FOR \'', user, '\'@\'', host, '\';') FROM mysql.user;

this produce a list of :

SHOW GRANTS FOR 'john'@'localhost';

then execute individual command to get permission of user

To create a new user in MySQL, execute the following SQL command within your MySQL client (e.g., MySQL Shell, phpMyAdmin, or a command-line interface):

Code

CREATE USER 'your_username'@'localhost' IDENTIFIED BY 'your_password';

• Replace 'your_username' with the desired username.
• Replace 'localhost' with the hostname or IP address from which the user will connect. Use '%' for any host.
• Replace 'your_password' with a strong, secure password for the new user.

This host measn the source IP of the user that can use to connect to 

if its test@123.456.789.123

if test is connecting from 155.155.155.231 test will be rejected

MY SQL grant permission 

GRANT ALL PRIVILEGES ON `<mydatabase>`.* TO `test`@`10.121.150.150`;

FLUSH PRIVILEGES;

• 
  
• 
  
• 
  
• Host Restriction:

  host specifies the allowed source(s) from which the user can connect. This can be:

  • localhost: Allows connections only from the same machine where the MySQL server is running (often using a Unix socket, or TCP/IP on 127.0.0.1).
  • A specific IP address (e.g., 192.168.1.100): Limits connections to that exact IP address.
  • A hostname (e.g., myclient.example.com): Restricts connections to that specific hostname.
  • A wildcard character (%): Allows connections from any host. This is often used for broad access but can pose security risks if not managed carefully.
  • An IP address range with wildcards (e.g., 10.0.%): Allows connections from any IP address within that specific range.

  ------------------------------------------------------------------------------------

  --------------------------------------------------------------------------------------

  What if mysql is running on server 172.168.11.110, the docker services running bridge network also in that machine, can docker user test@172.168.11.110 to conenct assume such user is created :
• 
  

Yes. MySQL decides which account to use based on the source IP it sees, and Docker’s NAT usually makes your container’s traffic look like it’s coming from the host’s IP (10.0.0.205) when it connects to a service on the host. So the server accepts test@10.0.0.205.

Why this happens

• Your container lives on a bridge subnet (e.g., 172.17.0.0/16).

• When the container connects to the host’s MySQL at 10.0.0.205:3306, Docker’s iptables rules do MASQUERADE/SNAT for packets leaving the bridge.

• Result: MySQL receives a connection from 10.0.0.205 → 10.0.0.205:3306 (hairpin NAT), which matches the MySQL user test@10.0.0.205.

How to confirm exactly what MySQL sees
Run this in your session after connecting from the container:

SELECT USER() AS client_says,
       CURRENT_USER() AS mysql_matched_account,
       SUBSTRING_INDEX(HOST, ':', 1) AS source_ip
FROM information_schema.processlist
WHERE ID = CONNECTION_ID();

• source_ip shows what IP MySQL thinks you’re coming from.

• CURRENT_USER() shows the precise user@host entry MySQL matched.