If you need your sql not to be accessed from Lan just from another container a simple iptables rule would help you denying traffic from Lan. Just a quick idea
Indeed I could, thanks for the tip.
Both your suggestions sounds good to me. I'll add them to my ToDo list together with the possibility to bind-mount files/folders in read-only mode. Before doing any change though I'll add the plugin to the Docker stable repo. Further changes will then be made in the testing repo and merged to stable when considered ready.
Thankyou very much - I will keep an eye out!