# Microsoft SQL Server Express

## Overview

Microsoft SQL Server 2022 Express runs alongside PostgreSQL for Silver projects that require Microsoft SQL Server compatibility.

Status:

```text
Operational
```

Verified version:

```text
Microsoft SQL Server 2022 Express Edition (64-bit)
Linux
Version 16.0.4255.1
```

---

## Service Information

| Property | Value |
| --- | --- |
| Container | `mssql` |
| Image | `mcr.microsoft.com/mssql/server:2022-latest` |
| Edition | Express |
| Docker network | `internal` |
| Compose location | `/srv/docker/mssql/docker-compose.yml` |
| Data location | `/srv/docker/mssql/data` |

Port `1433` is not published by Docker or exposed through Nginx Proxy Manager. Applications connect privately over the `internal` Docker network using hostname `mssql`.

Server-side administration must use `docker exec` or another container attached to `internal`; there is no host-bound SQL port in the current configuration.

---

## Secrets

The SA password is stored outside the repository:

```text
/srv/secrets/company.env
MSSQL_SA_PASSWORD
```

Never commit the value to Git or place it directly in the Compose file.

---

## Deployment

Docker Compose must be given the secrets file for interpolation:

```bash
cd /srv/docker/mssql
docker compose --env-file /srv/secrets/company.env up -d
```

The Compose `env_file:` setting passes variables into the container. It does not make them available while Compose resolves `${MSSQL_SA_PASSWORD}`, which is why `--env-file` is required.

Validate startup:

```bash
docker ps
docker logs mssql
```

Expected log message:

```text
SQL Server is now ready for client connections.
```

---

## Data Directory Permissions

The SQL Server container runs as UID and GID `10001`. For a new, empty deployment, initialize the bind-mounted directory with:

```bash
sudo mkdir -p /srv/docker/mssql/data
sudo chown -R 10001:10001 /srv/docker/mssql/data
sudo chmod -R 700 /srv/docker/mssql/data
```

Do not delete or recreate the directory after databases exist. Removing `/srv/docker/mssql/data` destroys the persisted SQL Server data.

---

## Troubleshooting

### Variable Is Not Set

If Compose reports that `MSSQL_SA_PASSWORD` is unset and defaults to a blank string, use the required `docker compose --env-file /srv/secrets/company.env up -d` command.

### System Directory Permission Denied

If `[/.system]` cannot be created, verify that `/srv/docker/mssql/data` is owned by `10001:10001` with mode `700`.

### Password Validation Failed

Confirm that the password meets SQL Server complexity requirements and that Compose resolved `MSSQL_SA_PASSWORD` from the secrets file.

---

## Related Documentation

* docs/server.md
* docs/services.md
* docs/security.md
* docs/secrets.md
* docs/backups.md
* dbgate/README.md
* postgres/README.md