The entry 3306:3306 publishes the database on all host interfaces. On a public server this can expose it to the internet. In the case described earlier, a bot wiped the data of such a setup with a weak password within a few hours.
Databases, caches and queues can talk to the application by service name on the Compose network. They usually do not need a ports section. When access from the host is required, limit it to 127.0.0.1:3306:3306.
Generate the password randomly, for example with openssl rand -hex 24. The project name and root are not suitable passwords. Contextadmin templates prepare random passwords and limit which services are published.
.
