Instead of publishing MySQL root password in environment as documented in MySQL container image, we could generate a temporary one, then use it to set the stable one from Vault.

For that, I'd suggest the following plan:

1. A flag-as-file ./auth_configured, not set as first, means a root password is already configured
2. We remove any credential from environment
3. At container launch, if .auth_configured is missing, a random temporary password is generated, set for MySQL and configured in a launcher: mysql -hlocalhost -uroot -p<generated password>
4. After container has been launched, if ./auth_configured is missing, a script is run by Salt to use the launcher: docker exec <instance> ./mysql-wrapper to do three things:
   • update root password, as set in Vault
   • delete the wrapper
   • touch .auth_configured