# Access a MySQL database

Last validated Aug 4, 2026

> **Note:** Border0 + Tailscale is currently in beta.

Use Border0 + Tailscale to provide fine-grained privileged access controls, credential management, and auditing for database sessions in your Tailscale network (known as a tailnet). This guide uses a MySQL Docker container as the database server.

## Prerequisites

Before you begin, confirm you have the following:

* A [connector][docs-border0-connectors].
* A device on your network that can run Docker.

## Run a local MySQL server with Docker

1. At a command line on your tailnet device that will host the database, run

   ```shell
   docker run --name <your-database-name> \
     --rm -e MYSQL_ROOT_PASSWORD=<your-database-password> \
     -d -p 3306:3306 mysql
   ```

   Replace `<your-database-name>` and `<your-database-password>` with the database name and password that you want to use for the database.

   The preceding command will start a local MySQL server listening on port `3306`, with`<your-database-password>` as root password.

2. Before proceeding to configure Border0 + Tailscale, verify your database is working locally as user `root` and password `<your-database-password>`.

   ```shell
   mysql -u root -p<your-database-password> \
     -h localhost --protocol TCP
   ```

3. If your database is working correctly, you command line shows a `mysql>` prompt. At the `mysql>` prompt, run a command to verify your database is working locally.

   ```sql
   SHOW VARIABLES LIKE 'version';
   ```

   If the command shows output similar to the following, your database is working locally.

   ```text
   +---------------+--------+
   | Variable_name | Value  |
   +---------------+--------+
   | version       | 8.0.30 |
   +---------------+--------+
   1 row in set (0.00 sec)
   ```

## Create a database socket

Create a database [socket][docs-border0-sockets] and link it to your connector.

1. In the Border0 admin portal, open the [**Sockets**][xt-border0-sockets-page] page.
2. Select **Add New Socket**.
3. Select **Database**.
4. In the list of database types, find the **MySQL** option and select **Create**.
5. Select **I will use my own MySQL server**.
6. In the **Socket Information** section:
   1. Provide a name for your socket. A socket name can have alphanumeric characters and hyphens, but it must start or end with an alphanumeric character.
   2. (Optional) Select **Add display name** and provide a display name for the socket.
   3. (Optional) Provide a description for the socket.
7. Choose whether the **Session Recording** option is enabled or disabled.
8. In the **Upstream Configuration** section:
   1. For **Service Type**, select **Standard**.
   2. For **Protocol**, select **MySQL**.
   3. For **Hostname**, use `localhost`. Adjust as needed for your database.
   4. For **Protocol**, use `3306`. Adjust as needed for your database.
   5. For **Authentication Type**, select **Username and Password**.
   6. (Optional) Select **Set database name** and provide a name for the database.
   7. For **Upstream Username**, use `root` as the username, because the MySQL username defaults to `root` if not specified. Adjust as needed for your database.
   8. For **Upstream Password**, use the password that you used when you created the database.
9. In the **Connectors** section, select the connector that you want to use for this socket.
10. (Optional) In the **Tags** section, select **Add tag** to add any tags that you want to use for the socket.
11. Select **Create New Socket**.

Your database socket should be created. You can access it in the [**Sockets**][xt-border0-sockets-page] page.

## Connect to your database

To access the database from the Border0 web client:

1. Open the [**Sockets**][xt-border0-sockets-page] page.
2. Select the database that you created.
3. Select **Connect**.
4. Follow the prompts to authenticate.
5. Successful authentication takes you to the client portal, where you have a web-based database session where you can run a SQL query like `SHOW DATABASES;`.

## Secure your credentials

In this guide, the credentials used for the upstream database are statically defined in the connector configuration. Credentials are essential for the connector to establish a secure connection. While Border0 stores these credentials in encrypted form, we strongly recommend that you keep the credentials local to the connector, instead of statically defining them. Specifically, for enhanced security and to keep your credentials local, you should integrate your connector with a secret management solution. For more information, refer to [Manage secrets and credentials][docs-border0-manage-secrets].

By default, the Border0 proxy attempts to establish a secure database connection using Transport Layer Security (TLS). If a database server does not support TLS, it will fall back to a non-TLS connection.

## Review session details and recordings

To review details like the identity, originating IP address, device, connection time, and a log of executed SQL queries, open the **Sessions** page and selection a session. For more information, refer to [Session logs][docs-border0-session-logs].

## Troubleshooting

If you experience issues with your new database socket, it's typically because it can't connect to the upstream database. For recommended actions, refer to [Troubleshooting Border0 connectors][docs-border0-connectors-troubleshooting].

[docs-border0-connectors-troubleshooting]: /docs/border0/connectors/reference/troubleshooting

[docs-border0-connectors]: /docs/border0/connectors

[docs-border0-manage-secrets]: /docs/border0/how-to/manage-secrets

[docs-border0-session-logs]: /docs/border0/session-logs

[docs-border0-sockets]: /docs/border0/services

[xt-border0-sockets-page]: https://portal.border0.com/mysockets