Diagnose socket, TCP and authentication failures

Understand the likely causes

• On Unix, localhost commonly selects a local socket while explicit TCP uses a host and port. Containers have separate filesystem and network namespaces. Authentication then depends on user@host matching, the selected plugin, connector support and transport requirements. A socket path mismatch is not repaired by granting more SQL privileges.

Classify the failed stage

Record the intended endpoint, protocol, port or socket path, client location and exact error. A missing socket file or refused TCP connection generally occurs before account authentication. Access denied indicates a server responded but rejected authentication or an access condition. Check existing deployment documentation and approved listener information before testing alternatives. Do not expose passwords in command lines, paste connection URLs into tickets or change root authentication to make an application login work.

Identify the server reached by a working session

An existing authorized training session can reveal server identity and configured endpoints. These queries do not establish a new connection and were not executed for this guide. @@hostname is the server-reported host, not proof of a particular network route. A socket path inside a database container need not exist in an application container. Use the evidence to correct the client endpoint through the normal deployment process rather than restarting services speculatively.

SELECT VERSION(), @@hostname, @@port;
SHOW VARIABLES LIKE 'socket';
SHOW VARIABLES LIKE 'skip_networking';

Compare authenticated identity and connection identity

CURRENT_USER() identifies the matched account used for privileges; USER() reports connection identity. A mismatch can be legitimate but should be understood. unix_socket authentication can use the operating-system identity for local socket access and does not automatically authorize TCP with the same username. Ask the authorized account owner to inspect plugin and host requirements through their established process; this guide supplies no account-changing SQL or wildcard-host grants.

SELECT CURRENT_USER(), USER(), CURRENT_ROLE();
SHOW GRANTS;

Match the remedy to the evidence

Correct a socket path only when the application shares that namespace and local socket access is intended. Correct host and port when TCP is intended, including container service naming. For an authentication rejection, verify the exact service account, host match, supported plugin and TLS policy; repair provisioning through a separate reviewed change if needed. A successful administrator socket session does not prove the application password, TCP reachability or application-role grants are correct.

Keep it from recurring

• Store explicit protocol and endpoint settings, document container boundaries, rotate service credentials through the normal secret system and test the same connector used in production. Keep administrative and application accounts separate, with a reviewed plugin and host policy.