cloider db command reference

Q: How do I get a database password with the CLI?

cloider db password orders-db prints the password of the database user to stdout. cloider db get orders-db shows the host, port, database name and user.

Q: How do I restore a database backup?

Run cloider db restore orders-db --wait to restore the newest full backup plus every change since, or add --time 2026-10-25T14:29:00Z for a moment of the last 14 days. The backup is restored into a new database; the original is not changed.

Q: How do I allow my IP address to connect to a database?

Run cloider db trusted-sources orders-db --add-my-ip. It looks up this machine's public IPv4 address and adds it to the database's trusted sources.

View as Markdown Open in Claude Open in ChatGPT

cloider db manages your managed databases: PostgreSQL, MySQL, MongoDB and Redis. It creates and deletes them, shows how to reach them, prints passwords and CA certificates, connects your local client, opens a client in the browser terminal, runs queries for scripts, lists and restores backups, resizes, renames, toggles SSL, controls who may connect, and shows resource usage.

cloider db <command> [flags]

Aliases: cloider database, cloider databases, cloider dbs. Every subcommand that takes <database> accepts the database's name (label), its original name or its id.

Subcommands

Command	Description
`cloider db list`	List databases
`cloider db get`	Show a database and how to reach it
`cloider db create`	Create a database
`cloider db delete`	Delete a database and its data
`cloider db pause`	Pause a database, keeping its data at a lower price until it is resumed
`cloider db resume`	Resume a paused database
`cloider db status`	Print a database's status
`cloider db password`	Print a database user's password
`cloider db cert`	Print the CA certificate that signs a database's TLS certificate
`cloider db connect`	Connect with the engine's own client (psql, mysql, redis-cli, mongosh)
`cloider db shell`	Open the engine's client inside the platform, already logged in
`cloider db exec`	Run a query or script with the database's client, for scripts and AI agents
`cloider db backups`	List a database's backups, newest first
`cloider db restore`	Restore a backup into a new database, leaving this one as it is
`cloider db resize`	Move a database to a larger plan (restarts it)
`cloider db rename`	Change the name a database is shown and found by
`cloider db ssl`	Require TLS on a database, or stop requiring it (restarts it)
`cloider db trusted-sources`	List or change who may connect to a database
`cloider db insights`	Show a database's resource usage today (`-o json` for the month)

All subcommands also take the global flags.

cloider db list

List the account's databases with their engine, plan and status.

cloider db list [flags]

Alias: cloider db ls.

cloider db list

Output
NAME         ENGINE          PLAN       STATUS   CREATED
orders-db    PostgreSQL 18   Standard   Ready    2026-09-02 14:12
shop-db      MySQL 9         Starter    Ready    2026-09-10 08:30
catalog-db   MongoDB 8       Basic      Paused   2026-09-18 17:02
cache        Redis 8         Hobby      Ready    2026-10-01 10:45

-o wide adds the ID column, -q prints the ids, and -o json prints the API's list with fields such as hashed_id, database_name, database_label, database_user, service, database_version, database_plan, trusted_sources, ssl, status and created_at.

# Every PostgreSQL database
cloider db list -o json | jq -r '.[] | select(.service == "PostgreSQL") | .database_label'

MCP tool: list_databases.

cloider db get

Show a database and how to reach it: hosts, port, database name, user, SSL and trusted sources. The password is printed by cloider db password.

cloider db get <database> [flags]

Alias: cloider db show.

Argument	Description
`<database>`	Name or id of the database

cloider db get orders-db

Output
Name:             orders-db
Engine:           PostgreSQL 18
Plan:             Standard
Status:           Ready
Host:             orders-db-p0q9zm.db.cloider.com
Private host:     orders-db-p0q9zm.db.cloider.internal
Port:             20417
Database:         orders-db
User:             orders_db_user
SSL:              yes
Trusted sources:  anywhere
Created:          2026-09-02 14:12

Password: `cloider db password orders-db`, connect: `cloider db connect orders-db`

Host is the public host, reachable from the internet if the trusted sources allow it.
Private host is reachable only from your own Cloider clusters and apps.
Trusted sources lists who may connect: anywhere, IPv4 addresses and ranges, cluster:<name> and app:<name>.

-o json adds host, private_host and database_port to the list fields:

cloider db get orders-db -o json | jq -r '"\(.host):\(.database_port)"'

Output
orders-db-p0q9zm.db.cloider.com:20417

See Connect to a database. MCP tool: get_database.

cloider db create

Create a database.

cloider db create <name> [flags]

Argument	Description
`<name>`	Name of the new database. It becomes the database name inside the engine and part of the host name

Flag	Type	Default	Description
`--engine`	string	(required)	`postgresql`, `mysql`, `redis` or `mongodb`. Also accepted: `postgres`, `pg`, `mongo`
`--version`	string	the newest offered	Engine version
`--plan`	string	`Hobby`	Plan: `Hobby`, `Starter`, `Basic`, `Standard`, `Plus` or `Pro` (any case). See `cloider pricing`
`--user`	string	`<name>_user`	Database user. Dashes in the name become underscores: `orders-db` gets `orders_db_user`
`--ssl`	bool	on, except for Redis	Require TLS
`--no-ssl`	bool	`false`	Don't require TLS. Can't be combined with `--ssl`
`--trusted-source`	string, repeatable	`*` (anywhere)	Who may connect: `*`, an IPv4 address or CIDR, `cluster:<name>` or `app:<name>`
`--allow-my-ip`	bool	`false`	Also trust the public IPv4 address this command runs from
`-w, --wait`	bool	`false`	Wait until the database is `Ready`
`--timeout`	duration	`15m0s`	How long `--wait` waits

The CLI checks the engine, version and plan against what Cloider offers before creating anything, and names the valid choices when one is wrong:

Error: PostgreSQL 15 isn't offered, pick one of: 18
Error: unknown plan "large", pick one of: Hobby, Starter, Basic, Standard, Plus, Pro (see `cloider pricing`)

SSL is on by default for every engine except Redis, where turning it on makes the server accept TLS connections only. --allow-my-ip asks a public IP lookup service (api.ipify.org) for this machine's address, as the dashboard's Allow My IP button does.

Create a PostgreSQL database with the defaults (Hobby plan, newest version, SSL, open to anywhere):

cloider db create orders-db --engine postgresql

Output
✓ Creating PostgreSQL 18 database orders-db (plan Hobby)
Follow it with `cloider db status orders-db`, or pass --wait next time.

A Redis cache only your app can reach, waiting until it is ready:

cloider db create cache --engine redis --plan starter --trusted-source app:blog --wait

Output
✓ Creating Redis 8 database cache (plan Starter)
✓ Database cache is ready. Connect with `cloider db connect cache`.

A MySQL database open to an office network and your current IP:

cloider db create shop-db --engine mysql --trusted-source 203.0.113.0/24 --allow-my-ip

A MongoDB database reachable from a cluster, with a custom user:

cloider db create catalog-db --engine mongodb --plan basic --user catalog --trusted-source cluster:production

-q prints the new id and -o json prints {"hashed_id": "..."}. See Create a database. MCP tool: create_database.

cloider db delete

Delete a database and its data.

cloider db delete <database> [flags]

Alias: cloider db rm.

Flag	Type	Default	Description
`-w, --wait`	bool	`false`	Wait until the database is gone
`--timeout`	duration	`15m0s`	How long `--wait` waits

The command asks you to type the database's name to confirm; pass --yes to skip it (required without a terminal).

cloider db delete shop-db

Output
This permanently deletes database shop-db.
Type shop-db to confirm: shop-db
✓ Deleting database shop-db

cloider db delete shop-db --yes --wait

See Pause, resume and delete. MCP tool: delete_database.

cloider db pause

Pause a database. It stops serving connections and keeps its data at a lower price until you resume it.

cloider db pause <database> [flags]

Flag	Type	Default	Description
`-w, --wait`	bool	`false`	Wait until the database is `Paused`
`--timeout`	duration	`15m0s`	How long `--wait` waits

cloider db pause catalog-db --wait

Output
✓ Pausing database catalog-db
✓ Database catalog-db is Paused

MCP tool: pause_database.

cloider db resume

Resume a paused database.

cloider db resume <database> [flags]

Flag	Type	Default	Description
`-w, --wait`	bool	`false`	Wait until the database is `Ready`
`--timeout`	duration	`15m0s`	How long `--wait` waits

cloider db resume catalog-db --wait

Output
✓ Resuming database catalog-db
✓ Database catalog-db is Ready

MCP tool: resume_database.

cloider db status

Print a database's status and nothing else.

cloider db status <database> [flags]

cloider db status orders-db

Output
Ready

With -o json it prints {"hashed_id": "...", "status": "Ready"}. See Status values.

cloider db password

Print the password of the database's user, to stdout and nothing else.

cloider db password <database> [flags]

cloider db password orders-db

Output
Xk9vQ2mL7pR4tW8zN3bY

# Build a connection string
export DATABASE_URL="postgresql://orders_db_user:$(cloider db password orders-db)@orders-db-p0q9zm.db.cloider.com:20417/orders-db?sslmode=require"

# User and password as JSON
cloider db password orders-db -o json      # {"user": "orders_db_user", "password": "..."}

MCP tool: get_database_password.

cloider db cert

Print the CA certificate that signs the database's TLS certificate, for clients that verify the server. A database with SSL off has none.

cloider db cert <database> [flags]

Flag	Type	Default	Description
`-f, --file`	string	stdout	Write to this file (mode `0600`) instead of stdout

cloider db cert cache -f ca.crt

Output
✓ Wrote the CA certificate of cache to ca.crt

cloider db cert orders-db > orders-ca.pem
psql "host=orders-db-p0q9zm.db.cloider.com port=20417 user=orders_db_user dbname=orders-db sslmode=verify-ca sslrootcert=orders-ca.pem"

With SSL off, it fails with exit code 4: database cache has SSL off, so it has no certificate (turn it on with `cloider db ssl ... on`). See SSL/TLS. MCP tool: get_database_ca_cert.

cloider db connect

Connect to the database with the engine's own client, already logged in: psql, mysql, redis-cli or mongosh. The client must be installed on your machine, and the database's trusted sources must allow where you connect from. cloider db shell needs nothing installed.

cloider db connect <database> [flags]

Flag	Type	Default	Description
`--print`	bool	`false`	Print the command instead of running it, without the password
`--private`	bool	`false`	Use the private host, reachable from your clusters and apps

cloider db connect orders-db

Output
psql (18.0)
SSL connection (protocol: TLSv1.3, cipher: TLS_AES_256_GCM_SHA384, compression: off)
Type "help" for help.

orders-db=>

The CLI fetches the password and hands it to the client through its environment variable (PGPASSWORD, MYSQL_PWD, REDISCLI_AUTH), so it doesn't show in your process list. mongosh has no such variable, so its password is passed as an argument. For Redis and MongoDB with SSL on, the CLI downloads the CA certificate into a temporary file for the client and removes it afterwards. When the client exits with an error, cloider db connect exits with the same code.

See the command for each engine with --print:

cloider db connect orders-db --print

Output
psql -h orders-db-p0q9zm.db.cloider.com -U orders_db_user -d orders-db -p 20417
Password: `cloider db password orders-db`

Engine	Command `--print` shows
PostgreSQL	`psql -h <host> -U <user> -d <database> -p <port>` (with `PGSSLMODE=require` when SSL is on)
MySQL	`mysql -h <host> -P <port> -u <user> <database> --ssl-mode=REQUIRED` (SSL on), or `--ssl-mode=DISABLED --get-server-public-key` (SSL off)
Redis	`redis-cli -h <host> -p <port> --user <user> --tls --cacert ca.crt` (`--tls --cacert` only with SSL on)
MongoDB	`mongosh mongodb://<user>@<host>:<port>/<database>?directConnection=true&tls=true --tlsCAFile ca.crt` (TLS parts only with SSL on)

If the client isn't installed, the command says so: psql isn't installed, install it or use `cloider db shell ...`, which needs nothing installed. If the database isn't Ready, it warns first. See Connect to a database.

There is no MCP tool for connect, since it runs an interactive client.

cloider db shell

Open the engine's client (psql, mysql, redis-cli or mongosh) running next to the database, already logged in, in an interactive terminal session. Nothing has to be installed, and the trusted sources don't apply. It is the same terminal as the database's Terminal tab in the dashboard. The CLI shows Starting the terminal… while it gets ready, and keeps the session open while you use it.

cloider db shell <database> [flags]

cloider db shell orders-db

Output
Connected, exit the shell to end the session.
orders-db=> SELECT count(*) FROM orders;
 count
-------
  1284
(1 row)

A shell needs a terminal on both ends; in scripts use cloider db exec. See Terminal and exec.

cloider db exec

Run a query or a script with the database's own client, already logged in and running next to the database, and exit with the client's exit code. Nothing has to be installed and the trusted sources don't apply, which makes it the way for scripts, CI jobs and AI agents to query a database.

cloider db exec [flags] <database> [--] <query...>

Argument	Description
`<database>`	Name or id of the database
`<query...>`	What to run. How the arguments are read depends on the engine, see below

Flag	Type	Default	Description
`-i, --stdin`	bool	`false`	Run a script from stdin instead of a query, up to 2 MiB
`--timeout`	duration	`10m0s`	Stop after this long, from `1s` up to `1h`

Engine	The arguments are	Run with
PostgreSQL	One SQL string	`psql -c`
MySQL	One SQL string	`mysql -e`
Redis	One command; one quoted argument is a command line	`redis-cli`
MongoDB	JavaScript	`mongosh --eval`

Flags for exec go before the database. Give either a query or -i, not both. A PostgreSQL script run with -i stops at its first error.

# PostgreSQL
cloider db exec orders-db "SELECT count(*) FROM orders"
cloider db exec orders-db "\dt"
cloider db exec -i orders-db < migration.sql

# MySQL
cloider db exec shop-db "SHOW TABLES"

# Redis
cloider db exec cache SET greeting "hello world"
cloider db exec cache GET greeting

# MongoDB
cloider db exec catalog-db "db.products.countDocuments()"

Output of the first command
 count
-------
  1284
(1 row)

One JSON object for a script or agent:

cloider db exec -o json orders-db "SELECT now()"

Output
{
  "exit_code": 0,
  "stdout": "              now\n-------------------------------\n 2026-10-20 09:41:07.112+00\n(1 row)\n\n",
  "stderr": "",
  "timed_out": false
}

The exit code is the client's own, 124 when --timeout stopped it. See exit codes of exec commands and Terminal and exec. MCP tool: database_exec.

cloider db backups

List a database's backups, newest first, and the start of its point-in-time window.

cloider db backups <database> [flags]

A database has a full backup every 14 days plus every change recorded since, so it has no listed backups. The command prints where its window starts instead:

cloider db backups orders-db

Output
Nothing to show.

Restore the newest full backup plus every change since with `cloider db restore orders-db`,
or any moment from 2026-10-13 01:31:07 UTC until now with `cloider db restore orders-db --time <time>`.

Snapshots of a Redis database taken before point-in-time recovery are listed in a BACKUP column, by the name cloider db restore takes (YYYY-MM-DD_HH-MM, UTC), until they expire, around mid-November 2026. -o json prints the names only, as a JSON array, [] when there are none. See Backups and restore. MCP tool: list_database_backups.

cloider db restore

Restore a backup into a new database, a fork of this one as it was then. The original database is left as it is. Without a backup or --time it restores the newest: the newest full backup plus every change since. A database can also be restored to any moment of the last 14 days with --time, for example right before a mistake.

cloider db restore <database> [backup] [flags]

Argument	Description
`<database>`	Name or id of the database to restore
`[backup]`	A Redis snapshot taken before point-in-time recovery, `YYYY-MM-DD_HH-MM`, as `cloider db backups` lists it, until it expires. Can also be given with `--backup`. Leave it out for the newest, or with `--time`

Flag	Type	Default	Description
`--backup`	string		Backup to restore, `YYYY-MM-DD_HH-MM`
`--time`	string		Restore to this moment instead of the newest. RFC 3339 (`2026-10-25T14:29:00Z`), or `"YYYY-MM-DD HH:MM:SS"` taken as UTC
`-w, --wait`	bool	`false`	Wait until the new database is `Ready`
`--timeout`	duration	`15m0s`	How long `--wait` waits

The command asks Restore ... into a new database? [y/N]. Pass --yes to skip it (required without a terminal).

cloider db restore orders-db --wait

Output
Restore orders-db from the newest backup into a new database? [y/N] y
✓ Restoring orders-db from the newest backup into a new database orders-db-2026-10-27-09-12-03
✓ The restored database is ready: `cloider db get orders-db-2026-10-27-09-12-03`

To a point in time:

cloider db restore orders-db --time 2026-10-25T14:29:00Z --wait

Output
Restore orders-db as of 2026-10-25 14:29:00 UTC into a new database? [y/N] y
✓ Restoring orders-db from 2026-10-25 14:29:00 UTC into a new database orders-db-2026-10-25-14-29-00
✓ The restored database is ready: `cloider db get orders-db-2026-10-25-14-29-00`

The new database is named after the original and the moment restored to, <name>-YYYY-MM-DD-HH-MM-SS (plus -1, -2 if that name is taken). It has the same user, password, plan, version, trusted sources and SSL setting as the original. -q prints its id and -o json prints {"hashed_id", "database_label"}. MCP tool: restore_database_backup.

cloider db resize

Move a database to a larger plan. Resizing restarts the database.

cloider db resize <database> [flags]

Flag	Type	Default	Description
`--plan`	string	(required)	The larger plan: `Starter`, `Basic`, `Standard`, `Plus` or `Pro` (any case)
`-w, --wait`	bool	`false`	Wait until the database is `Ready` again
`--timeout`	duration	`15m0s`	How long `--wait` waits

The command asks Resize ... from ... to ...? It restarts the database. [y/N]; pass --yes to skip it.

cloider db resize orders-db --plan plus --wait

Output
Resize orders-db from Standard to Plus? It restarts the database. [y/N] y
✓ Resizing orders-db to Plus
✓ Database orders-db runs on Plus

See Resize a database and compare plans with cloider pricing. MCP tool: resize_database.

cloider db rename

Change the name a database is shown and found by (its label). Its host, user and database name stay as they are, so nothing that connects to it breaks.

cloider db rename <database> <new-name> [flags]

cloider db rename orders-db orders-primary

Output
✓ Renamed orders-db to orders-primary

MCP tool: rename_database.

cloider db ssl

Require TLS on a database, or stop requiring it. Changing SSL restarts the database.

cloider db ssl <database> on|off [flags]

Argument	Description
`<database>`	Name or id of the database
`on\|off`	`on` (also `true`, `yes`, `enable`, `enabled`) or `off` (also `false`, `no`, `disable`, `disabled`)

Flag	Type	Default	Description
`-w, --wait`	bool	`false`	Wait until the database is `Ready` again
`--timeout`	duration	`15m0s`	How long `--wait` waits

The command asks Turn SSL on for ...? It restarts the database. [y/N]; pass --yes to skip it.

cloider db ssl orders-db on --yes --wait

Output
✓ Turning SSL on for orders-db
✓ Database orders-db is ready

See SSL/TLS. MCP tool: set_database_ssl.

cloider db trusted-sources

List or change who may connect to a database over the network. Without flags it lists the trusted sources; with flags it changes them and then lists the result.

cloider db trusted-sources <database> [flags]

Alias: cloider db firewall.

Flag	Type	Default	Description
`--set`	string, repeatable		Replace the list with these sources
`--add`	string, repeatable		Add a source
`--remove`	string, repeatable		Remove a source
`--add-my-ip`	bool	`false`	Add the public IPv4 address this command runs from

A source is one of:

Source	Example	Allows
`*` (also `0.0.0.0/0` or `anywhere`)	`--set '*'`	Any address on the internet
An IPv4 address	`--add 203.0.113.7`	That address (stored as `203.0.113.7/32`)
An IPv4 CIDR range	`--add 203.0.113.0/24`	That network
`cluster:<name>`	`--add cluster:production`	Your Cloider cluster
`app:<name>`	`--add app:blog`	Your Cloider app

Adding * replaces the whole list, and adding anything else removes *, as in the dashboard. The order is: --set, then --remove, then --add, then --add-my-ip. A change that would leave nobody able to connect fails with that leaves nobody able to connect; use '*' to allow anywhere.

cloider db trusted-sources orders-db

Output
SOURCE   TYPE       NAME
*        Anywhere   Allow Everything

Lock a database down to an app, a cluster and one office IP:

cloider db trusted-sources orders-db --set app:blog --set cluster:staging --add 203.0.113.7

Output
✓ Updated who may connect to orders-db
SOURCE           TYPE      NAME
q7w2e9r4t1       App       blog
k3m9x2p7q1       Cluster   staging
203.0.113.7/32   Custom    203.0.113.7/32

# Allow your own IP for a local psql session, then remove it again
cloider db trusted-sources orders-db --add-my-ip
cloider db trusted-sources orders-db --remove 198.51.100.24

See Trusted sources. MCP tool: update_database_trusted_sources.

cloider db insights

Show how much of its plan a database uses today: CPU, memory, storage, disk and network throughput, and connections. -o json prints the API's full answer, with the month so far.

cloider db insights <database> [flags]

cloider db insights orders-db

Output
Date:         2026-10-20
CPU:          142 millicores
Memory:       612 MiB
Storage:      3.41 GiB
Disk read:    18.2 KiB/s
Disk write:   96.4 KiB/s
Network in:   41.7 KiB/s
Network out:  233.0 KiB/s
Connections:  14 (max 100)

Early in the day, before anything was recorded, it says No usage recorded for today yet. A paused database records nothing. See Database insights. MCP tool: get_database_insights.

Frequently asked questions

How do I create a PostgreSQL database with the Cloider CLI?

Run cloider db create orders-db --engine postgresql --wait. Add --plan to pick a plan (Hobby by default), --version for an engine version, and --trusted-source to limit who may connect.

How do I connect to a Cloider database from my terminal?

Run cloider db connect orders-db, which starts psql, mysql, redis-cli or mongosh already logged in, if the client is installed and the trusted sources allow your IP. cloider db shell orders-db opens the client in Cloider's terminal with nothing installed.

How do I run a SQL query from a script?

Use cloider db exec orders-db "SELECT count(*) FROM orders", or cloider db exec -i orders-db < migration.sql for a script. It exits with the client's exit code, and -o json returns exit_code, stdout and stderr in one object.

How do I get a database password with the CLI?

cloider db password orders-db prints the password of the database user to stdout. cloider db get orders-db shows the host, port, database name and user.

How do I restore a database backup?

Run cloider db restore orders-db --wait to restore the newest full backup plus every change since, or add --time 2026-10-25T14:29:00Z for a moment of the last 14 days. The backup is restored into a new database; the original is not changed.

How do I allow my IP address to connect to a database?

Run cloider db trusted-sources orders-db --add-my-ip. It looks up this machine's public IPv4 address and adds it to the database's trusted sources.

Subcommands​

cloider db list​

cloider db get​

cloider db create​

cloider db delete​

cloider db pause​

cloider db resume​

cloider db status​

cloider db password​

cloider db cert​

cloider db connect​

cloider db shell​

cloider db exec​

cloider db backups​

cloider db restore​

cloider db resize​

cloider db rename​

cloider db ssl​

cloider db trusted-sources​

cloider db insights​

Related​