Cargo

Managed Databases

Each organization can provision managed database instances directly from the UI — no separate tooling, no connection strings to assemble by hand.

Engines

Pick an engine from the logo cards in the create dialog, then a version:

Engine Versions Injected variable
PostgreSQL 16, 17 DATABASE_URL
MySQL 8.4, 8.0 MYSQL_URL
MongoDB 7, 6 MONGODB_URL
Redis 7 REDIS_URL

Provisioning pulls the engine image and waits for the instance to accept authenticated connections before marking it ready — the first MySQL or MongoDB instance takes a while, since those images are hundreds of megabytes.

Attaching to an app

Attach an instance to an app to grant it per-app, isolated credentials — its own database/user, not the admin account. Attaching injects the engine’s connection variable into the app’s environment at deploy time.

One attachment per engine per app, so an app can hold one of each simultaneously. Detaching drops the per-app credentials again.

Redis instances offer a shared mode (one password) or ACL mode (per-app ACL users), chosen at creation.

Storage, snapshots, and logs

  • Data lives in volumes under <dataDir>/databases/<id>

  • Manual snapshots can be triggered from the UI and are written to <dataDir>/db-backups/<id>/, downloadable from the UI:

    Engine Method File
    Postgres pg_dumpall --clean .sql
    MySQL mysqldump --all-databases .sql
    MongoDB mongodump archive .archive
    Redis BGSAVE + LASTSAVE-verified copy of dump.rdb .rdb

  • Provisioning logs land in <dataDir>/db-logs/ and are viewable per instance in the UI

Snapshots contain admin credentials or password hashes, so taking and downloading them requires the admin role in the org.

These are your data backups, not the platform's

Managed-database snapshots are separate from Cargo's own scheduled control-plane backups, which cover users, orgs, apps, and encrypted secrets — see Operations & Hardening.

Redis modes

Redis instances choose between two modes at creation. Both give each attached app its own ACL user and its own logical database index, so no app can read another’s keys or flush the instance:

Mode Pub/sub Use when
acl Disabled (channels are global, not scoped to an index) Default. Maximum isolation
shared Apps can publish/subscribe to each other’s channels An app needs pub/sub

Pick shared only if an app genuinely needs pub/sub; acl is the safer default.

**Exposing a host port**

Instances can optionally expose a host port for external clients (e.g. a local psql or redis-cli). Only enable this if you understand the instance will be reachable from outside the docker network.