Deploy CloudBeaver — Self-Hosted Web Database Manager [Updated Sep'26]

Deploy and Host CloudBeaver on Railway

CloudBeaver is a web-based database manager from the team behind DBeaver — a browser SQL editor, data grid, and admin tool for PostgreSQL, MySQL, MariaDB, SQLite, MongoDB, and dozens of other databases. Give your whole team a shared, self-hosted GUI to browse schemas, run queries, and edit data, with no desktop client to install and no per-seat licensing. This template deploys CloudBeaver Community Edition with a persistent volume and an admin account, handling Railway's port and login gotchas — so your team's database console is live in minutes.

What This Template Deploys

A single lightweight service. A persistent Railway volume at /opt/cloudbeaver/workspace holds all your saved connections, users, and configuration. CloudBeaver connects out to whichever databases you point it at — the ones you already run on Railway (over the private network) or anywhere else — so it needs no bundled database of its own.

About Hosting

CloudBeaver is simple to run, and three specifics decide whether it deploys cleanly and keeps your work — all handled here.

Persist the workspace volume — or lose every connection. This is the critical one: CloudBeaver stores all of its state — saved database connections, users, roles, and configuration — under /opt/cloudbeaver/workspace. Without a volume there, everything is wiped on every redeploy, so you'd re-add every database connection each time. This template mounts the volume, so your connections and settings persist across redeploys — a console you set up once, not one you rebuild constantly.

Your admin password must meet the policy — or the first login fails. A non-obvious gotcha: CloudBeaver enforces a password policy, so CB_ADMIN_PASSWORD must be at least 8 characters with mixed case and a digit, or your very first login is rejected — and ten failed attempts lock the account for five minutes. This template sets a compliant admin password so you can sign in immediately, along with CB_ADMIN_NAME and CB_SERVER_NAME.

Don't override the start command — the port mapping needs it. CloudBeaver's entrypoint maps Railway's $PORT to CLOUDBEAVER_WEB_SERVER_PORT and then runs the upstream initialization, so the app binds where Railway routes. Overriding the start command skips that mapping and the init, and the service won't be reachable — so leave it alone. Railway terminates TLS for your generated domain.

Lock it down, and connect the databases you already run. CloudBeaver can browse and edit real data, so this template sets CLOUDBEAVER_APP_ANONYMOUS_ACCESS_ENABLED=false to require login rather than leaving the console open; supply database credentials as Railway variables, never in files. From the UI, add connections to PostgreSQL, MySQL, MariaDB, SQLite, MongoDB, and more via built-in drivers — and for databases in the same Railway project, connect over the private network for speed and to avoid exposing them publicly, so CloudBeaver becomes the single shared window into all of them.

Typical cost: ~$5–10/month on Railway for the lightweight service and volume. CloudBeaver Community Edition is Apache-2.0 and free — no seat limits and no feature keys, unlike commercial database GUIs.

How It Compares

Desktop clients like DBeaver are powerful but installed per machine, with no shared team access. Adminer and phpMyAdmin are handy but typically single-engine and lighter on features. Cloud database consoles are tied to one vendor's databases. CloudBeaver's edge is a shared, browser-based console across many database engines with users and roles — self-hosted, so your team queries every database from one place, with connections and credentials on infrastructure you own.

Deploy in Under 5 Minutes

1. Click Deploy on Railway — CloudBeaver builds with a workspace volume (~2 minutes)
2. Confirm the volume is mounted at /opt/cloudbeaver/workspace and the admin password meets the policy
3. Open your Railway URL and sign in with your admin credentials
4. Add a database connection — for a Railway database, use its private-network host
5. Browse schemas, run queries in the SQL editor, and manage data from the grid

Leave the start command untouched so Railway's port mapping works, and connect databases privately.

Common Use Cases

• Shared team database console — one browser GUI for your whole team, no desktop installs
• Manage your Railway databases — query and edit your Postgres or MySQL over the private network
• Data browsing and edits — inspect tables, run ad-hoc queries, and fix data in a grid
• Role-based database access — give teammates scoped access without sharing raw credentials

Configuration

Persist the workspace and meet the password policy. All connections and config live at /opt/cloudbeaver/workspace — without the volume they're lost on redeploy. CB_ADMIN_PASSWORD must be 8+ chars with mixed case and a digit, or first login fails and ten tries lock the account.

Don't override the start command, and require login. The entrypoint maps $PORT and runs init — overriding it breaks routing. CLOUDBEAVER_APP_ANONYMOUS_ACCESS_ENABLED=false keeps the console behind a login.

Dependencies for CloudBeaver Hosting

• Railway account — ~$5–10/month for the lightweight service and volume
• A persistent volume at /opt/cloudbeaver/workspace for connections and config (included)
• One or more databases to connect to (yours on Railway, or anywhere reachable)
• A modern web browser — no desktop client to install

Deployment Dependencies

• CloudBeaver GitHub Repository
• CloudBeaver Documentation
• CloudBeaver Docker Image
• Railway Private Networking

Implementation Details

The template runs the official dbeaver/cloudbeaver image (a Java web application) on port 8978, with a Railway volume mounted at /opt/cloudbeaver/workspace that holds all CloudBeaver state — saved connections, users, roles, and configuration — so a volume is essential or all data is lost on every redeploy. The entrypoint maps Railway's $PORT to CLOUDBEAVER_WEB_SERVER_PORT and delegates to the upstream initialization, so the start command must not be overridden; Railway terminates TLS for the generated domain.

The admin account is created from CB_ADMIN_NAME and CB_ADMIN_PASSWORD, and the password must satisfy CloudBeaver's built-in policy — at least eight characters with mixed case and a digit — or the first login is rejected, with ten failures locking the user for five minutes. CLOUDBEAVER_APP_ANONYMOUS_ACCESS_ENABLED=false requires authentication, and database credentials should be provided as environment variables. CloudBeaver connects out to external databases via built-in drivers for PostgreSQL, MySQL, MariaDB, SQLite, MongoDB, and many others; databases within the same Railway project should be reached over the private network. The /opt/cloudbeaver/workspace volume is the single backup target.

Frequently Asked Questions

Will I lose my database connections on a redeploy? Not with this template — it mounts a volume at /opt/cloudbeaver/workspace, where all connections, users, and config live. Without that volume, everything is wiped on every redeploy, which is the main CloudBeaver self-hosting pitfall this closes.

Why does my first login fail? Almost always the admin password — CloudBeaver requires at least 8 characters with mixed case and a digit, or it rejects the first login, and ten failures lock the account for five minutes. This template sets a compliant password.

Is it secure? This template sets CLOUDBEAVER_APP_ANONYMOUS_ACCESS_ENABLED=false to require login, since CloudBeaver can browse and edit real data. Keep your admin account secure and supply database credentials as variables, not in files.

Why Deploy CloudBeaver on Railway?

Railway is a singular platform to deploy your infrastructure stack. Railway will host your infrastructure so you don't have to deal with configuration, while allowing you to vertically and horizontally scale it.

By deploying CloudBeaver on Railway you get a shared, web-based database console with the hard parts solved — a persistent volume so your connections survive redeploys, a policy-compliant admin account, the port mapping handled, and login required. Query and manage all your databases from the browser, self-hosted on infrastructure you own.