PXM copies selected MySQL or PostgreSQL databases into a new managed service. It does not adopt an existing data directory, stop the source server, modify its users, or rewrite its configuration. You can select several databases together. The destination is registered only after the copy passes verification and remains stopped until you start it.
A PXM Pro license is required to create an imported service and download its engine. Restoring an existing authenticated PXM portable backup remains available offline through service backup-import, including Redis recovery.
Find local servers
pxm service detect pxm service detect --json
Detection checks real loopback listeners and database protocol responses, including identifiable nonstandard local database ports. It does not infer a running database from a leftover folder. Detection does not authenticate or enumerate schemas. An empty result means no reachable supported listener was found, not that every stopped installation or socket-only server was searched.
Discovery retries slow protocol responses and has a 15-second overall budget. If the scan cannot complete, PXM reports that it was incomplete. Try again, or import directly with an explicit --source-host and --source-port; a scan timeout does not mean your server is missing.
Copy several databases
Pause application writes, background jobs, and schema migrations while the copy is prepared. Keep the source database running. The source account needs permission to read the selected schemas, export their objects and data, and inspect their metadata.
pxm service import mysql \ --name mysql-imported \ --source-host 127.0.0.1 --source-port 3306 --source-user root \ --databases shop,blog \ --app-user my_application \ --port 3306 --trust-source
PXM requests the source password and the application password with terminal echo disabled. Use the application's existing password if it should keep that credential after cutover. Passwords are not accepted in command arguments or environment variables. Source passwords are passed to the database clients through an inherited private file descriptor that is unlinked before execution.
To select every accessible non-system database, replace --databases shop,blog with --all-databases. The maximum is 128 databases per operation. PostgreSQL uses the same flow:
pxm service import postgresql \ --name postgres-imported \ --source-port 5432 --source-user postgres \ --all-databases --app-user my_application \ --port 5432 --trust-source
Only loopback source addresses are accepted. For another machine, create a private SSH tunnel and use its local port. PXM does not open the source to the network.
Accounts and permissions
Source global accounts, administrator roles, passwords and global grants are not copied. --app-user explicitly recreates one non-administrator application login with the password you enter, restricted to the selected databases. This is a new grant arrangement, not a claim that every source permission was preserved. Other applications need their own reviewed grants.
MySQL stored-object DEFINER headers are mapped to the requested restricted application user, or a new private import owner when no application user is requested. Both are restricted to the selected databases. SQL SECURITY DEFINER and INVOKER semantics remain in the object definitions. The original privileged source account is not recreated. PostgreSQL objects are restored under a new restricted owner; the optional application role receives membership in that owner role. PostgreSQL source ACLs and global roles are not restored.
Without --app-user, PXM creates new administrator credentials. Display them explicitly when needed:
pxm service env mysql-imported
Do not paste that command's output into public logs. Ordinary service information and import reports exclude passwords.
Use the same port
The copy is restored and checked on a temporary loopback port. The source can therefore continue occupying 3306 or 5432 while the copy is prepared. The newly registered service has autostart off and is stopped.
After verification, keep application writes paused, gracefully stop the source service in its original manager, and start the imported service:
pxm service start mysql-imported
PXM refuses to start if another process still owns the requested port. It does not stop that process. Test the application with the imported database and explicit application credentials before resuming writes. Keep the original source and an independent backup until the cutover has been accepted. Writes made to the source after export are not automatically synchronized.
Import a selected dump
A dump contains executable database code. --trust-source confirms that you trust the server or file. Restore runs under a restricted database owner, but this is not a sandbox for arbitrary malicious SQL.
Place the dump outside PXM's data directory, owned by the current user with mode 0600. Symlinks, hard links and publicly readable dumps are refused. One selected dump imports one named database:
chmod 600 /absolute/path/shop.sql pxm service import mysql --name mysql-copy \ --databases shop --dump /absolute/path/shop.sql --trust-source chmod 600 /absolute/path/shop.dump pxm service import postgresql --name postgres-copy \ --databases shop --dump /absolute/path/shop.dump --trust-source
PostgreSQL requires a pg_dump --format=custom archive. Executable psql scripts are not accepted. MySQL accepts a single-database SQL dump compatible with a restricted restore. Dumps containing global users, unsupported external resources or privileged operations fail instead of partially publishing a service.
For automation, supply a single private JSON object on stdin rather than command-line passwords:
pxm service import mysql --name mysql-imported \ --source-user root --databases shop,blog \ --app-user my_application --trust-source < /private/import-credentials.json
The private file has sourcePassword and applicationPassword string fields. Restrict it to mode 0600, do not commit it, and remove it when no longer needed. Omit the application field when no application user is requested. A dump import without an application user requires no credential input.
Verification and boundaries
For a live source, PXM records schema metadata, complete sorted row fingerprints, duplicate-sensitive row counts, PostgreSQL sequence values and large-object content before export. It rechecks the source after export and compares the restored destination. A change or mismatch prevents publication. Metadata and row verification require time proportional to the database size and may require the database server to sort data. Plan free disk space and a maintenance window accordingly.
PXM keeps a private import-report.json, dump hashes and the retained exported dumps in the new service directory. Failed or interrupted work stays unpublished and stopped with the original source untouched. Review the reported private path before removing any failed copy. A selected file can be restored and inventoried, but PXM cannot compare it with an original server it was not given; the report says so explicitly.
The qualified source families are Oracle MySQL 8.4 and 9.7 and PostgreSQL 17 and 18. The target engine must not be older than the source major version. MySQL minor compatibility-line downgrades are also refused. MariaDB is not qualified by the MySQL importer. Redis uses authenticated PXM portable backup recovery, not this logical server importer.
Automatic MySQL consistency requires InnoDB tables and lower_case_table_names=0, matching the case-sensitive Linux target. Dumps containing NO_BACKSLASH_ESCAPES or ANSI_QUOTES are refused because these modes change SQL quote interpretation during safe DEFINER remapping. PostgreSQL currently requires UTF-8 databases with a libc locale available on the destination. Foreign tables, unavailable or privileged extensions, arbitrary external tablespaces, unusual database names, global role policies and unsupported privileged dump operations need a reviewed vendor migration. Unsupported objects are not silently omitted. Database names must start with a letter or underscore and use letters, digits, underscores, dollar signs or hyphens, up to 63 characters. Reserved system databases are excluded.