"My MySQL is safe, it's bound to localhost"

Check before you believe it. Default MySQL on some images binds 0.0.0.0, and a stray GRANT ... TO 'root'@'%' from a tutorial leaves the door open.
Verify, don't assume:
— ss -tlnp | grep 3306 — must show 127.0.0.1, not 0.0.0.0
— SELECT user,host FROM mysql.user; — kill any % hosts
— set bind-address = 127.0.0.1 explicitly
"Should be localhost" has owned a lot of boxes. Try it tonight.