diff --git a/.gitignore b/.gitignore
index c75c18c855c..c34ccb0b0cb 100644
--- a/.gitignore
+++ b/.gitignore
@@ -12,3 +12,4 @@ npm-debug.log
 .idea/
 .dccache
 
+.env
diff --git a/README.md b/README.md
index 59b2aba12ad..4c54659e6c2 100644
--- a/README.md
+++ b/README.md
@@ -30,10 +30,15 @@ docker run --rm -p 27017:27017 mongo:3
 
 ## Running with docker-compose
 ```bash
+export MYSQL_PASSWORD='<choose a strong password>'   # or put it in a .env file
 docker-compose up --build
 docker-compose down
 ```
 
+The app connects to MySQL as the non-root `MYSQL_USER` (default `goof`) with `MYSQL_PASSWORD`; the MySQL root password is randomly generated. MongoDB and MySQL are only reachable on the compose network and are not published on the host.
+
+When running Goof outside docker-compose, set `MYSQL_HOST`, `MYSQL_PORT`, `MYSQL_USER`, `MYSQL_PASSWORD` and `MYSQL_DATABASE` to point at your MySQL server.
+
 ### Heroku usage
 Goof requires attaching a MongoLab service to be deployed as a Heroku app. 
 That sets up the MONGOLAB_URI env var so everything after should just work. 
diff --git a/docker-compose.yml b/docker-compose.yml
index d505ab892d2..efae1f2ed57 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1,27 +1,38 @@
-version: "2"
+version: "2.1"
 services:
   goof:
     build: .
     container_name: goof
     environment:
       - DOCKER=1
+      - MYSQL_HOST=goof-mysql
+      - MYSQL_USER=${MYSQL_USER:-goof}
+      - MYSQL_PASSWORD=${MYSQL_PASSWORD:?set MYSQL_PASSWORD in the environment or a .env file}
+      - MYSQL_DATABASE=acme
     ports:
       - "3001:3001"
       - "9229:9229"
     links:
       - goof-mongo
+      - good-mysql
     depends_on:
-      - goof-mongo
+      goof-mongo:
+        condition: service_started
+      good-mysql:
+        condition: service_healthy
   goof-mongo:
     container_name: goof-mongo
     image: mongo:3
-    ports:
-      - "27017:27017"
   good-mysql:
     container_name: goof-mysql
     image: mysql:5
     environment:
-      MYSQL_ROOT_PASSWORD: root
+      MYSQL_RANDOM_ROOT_PASSWORD: "yes"
       MYSQL_DATABASE: acme
-    ports:
-      - "3306:3306"
+      MYSQL_USER: ${MYSQL_USER:-goof}
+      MYSQL_PASSWORD: ${MYSQL_PASSWORD:?set MYSQL_PASSWORD in the environment or a .env file}
+    healthcheck:
+      test: ["CMD-SHELL", "mysql -h 127.0.0.1 -u\"$$MYSQL_USER\" -p\"$$MYSQL_PASSWORD\" -e 'SELECT 1' acme"]
+      interval: 5s
+      timeout: 5s
+      retries: 30
diff --git a/typeorm-db.js b/typeorm-db.js
index dd6912b5c68..9a417a63fc7 100644
--- a/typeorm-db.js
+++ b/typeorm-db.js
@@ -6,11 +6,11 @@ const Users = require("./entity/Users")
 typeorm.createConnection({
   name: "mysql",
   type: "mysql",
-  host: "localhost",
-  port: 3306,
-  username: "root",
-  password: "root",
-  database: "acme",
+  host: process.env.MYSQL_HOST || "localhost",
+  port: Number(process.env.MYSQL_PORT) || 3306,
+  username: process.env.MYSQL_USER || "goof",
+  password: process.env.MYSQL_PASSWORD,
+  database: process.env.MYSQL_DATABASE || "acme",
   synchronize: true,
   "logging": true,
   entities: [