Setup keycloak with mysql via docker compose

Question

I've been trying to get keycloak running for a bit now. I had it going using the legacy tag but it seems like bad practice to get started with a legacy version. So I wanted to get the most recent version running. This is my docker compose config, but somehow It wont work. It has something todo with the database connection but I cant figure out what's going wrong.

version: '3'
volumes:
  mysql_data2:
      driver: local
services:
  mysql:
      container_name: keycloak_mysql
      image: mysql:5.7
      volumes:
        - mysql_data2:/var/lib/mysql
      environment:
        MYSQL_ROOT_PASSWORD: MyRootPassword
        MYSQL_DATABASE: keycloak
        MYSQL_USER: keycloak
        MYSQL_PASSWORD: MyKeycloakMySQLPassword
  keycloak:
      container_name: keycloak_keycloak
      image: quay.io/keycloak/keycloak:22.0.3
      environment:
        KC_DB: MYSQL
        KC_DB_URL_HOST: mysql
        KC_DB_SCHEMA: keycloak
        KC_DB_USERNAME: keycloak
        KC_DB_PASSWORD: MyKeycloakMySQLPassword
        KEYCLOAK_ADMIN: admin
        KEYCLOAK_ADMIN_PASSWORD: MyKeycloakAdminPassword
        KC_HOSTNAME_STRICT: "false"
        KC_HTTP_RELATIVE_PATH: "/keycloak"
        KC_PROXY: "edge"
      ports:
        - 8080:8080
        - 8443:8443 
      depends_on:
        - mysql
      command:
        - "start"

Answer 1

I think the KC_DB_ environment variables are supposed to be just DB_. If I rewrite your compose.yaml like this...

  keycloak:
      container_name: keycloak_keycloak
      image: quay.io/keycloak/keycloak:22.0.3
      environment:
        DB: MYSQL
        DB_URL_HOST: mysql
        DB_SCHEMA: keycloak
        DB_USERNAME: keycloak
        DB_PASSWORD: MyKeycloakMySQLPassword

...then it starts up without errors and I can connect to the console at http://localhost:8080/keycloak/.

---

A couple of comments unrelated to your question:

Your depends_on is effectively a no-op, because it just waits for successful container startup; it doesn't know whether or not mysql is ready to accept connections. To make it useful you need to (a) implement a health check on the mysql container and then (b) use the extended form of depends_on. Something like:

volumes:
  mysql_data2:
    driver: local

services:

  mysql:
    image: mysql:5.7
    volumes:
      - mysql_data2:/var/lib/mysql
    environment:
      MYSQL_ROOT_PASSWORD: MyRootPassword
      MYSQL_DATABASE: keycloak
      MYSQL_USER: keycloak
      MYSQL_PASSWORD: MyKeycloakMySQLPassword

      # This provides the password to the healthcheck command
      MYSQL_PWD: MyRootPassword
    healthcheck:
      test:
        - CMD
        - mysql
        - -e
        - select 1
      interval: 10s
      start_period: 20s
      timeout: 5s

  keycloak:
    depends_on:
      mysql:
        condition: service_healthy
    image: quay.io/keycloak/keycloak:22.0.3
    environment:
      DB: MYSQL
      DB_URL_HOST: mysql
      DB_SCHEMA: keycloak
      DB_USERNAME: keycloak
      DB_PASSWORD: MyKeycloakMySQLPassword
      KEYCLOAK_ADMIN: admin
      KEYCLOAK_ADMIN_PASSWORD: MyKeycloakAdminPassword
      KC_HOSTNAME_STRICT: 'false'
      KC_HTTP_RELATIVE_PATH: /keycloak
      KC_PROXY: edge
    ports:
      - 8080:8080
      - 8443:8443
    command:
      - start

Lastly, on my system I was experiencing very long startup times for the mysql container. I was able to resolve this by constraining the number of open files:

  mysql:
    ulimits:
      nofile:
        soft: 1024
        hard: 1024

This is probably not appropriate for a production configuration, but it reduced the startup time from at least a minute to just a few seconds.