Prisma ORM Error P1001: Can't reach database server

Critical↻ Retryable · exponential backoffHTTP 503 Service UnavailableNetwork

TL;DR · 10-second read

Prisma could not open a TCP connection to the host and port in DATABASE_URL. Check the host, port, firewall/IP allowlist and whether the database is paused or still booting.

Identify: does your log match?

What you see · exact log / response

Error: P1001: Can't reach database server at `db.example.com:5432`

Please make sure your database server is running at `db.example.com:5432`.

High
Wrong host inside Docker
DATABASE_URL uses localhost, but inside a container localhost is the container itself. Use the compose service name (e.g. db).
Medium
IP allowlist or security group
Managed databases (RDS, Supabase, Neon IP Allow) drop traffic from unlisted IPs, so the connect times out.
Medium
Database suspended or cold-starting
Serverless Postgres scales to zero; the first connection after idle can exceed connect_timeout (default 5s).

Fix

Use the compose service name, not localhost

✕ Broken · CLI

# docker-compose.yml (app service)
environment:
  DATABASE_URL: postgresql://postgres:postgres@localhost:5432/app

✓ Fixed · CLI

# docker-compose.yml (app service)
environment:
  DATABASE_URL: postgresql://postgres:postgres@db:5432/app
depends_on:
  db:
    condition: service_healthy

Compose puts services on a shared network where each service name resolves via DNS. service_healthy waits for the db healthcheck before starting the app.

Verify: reproduce it on purpose

Reproduce locally · prisma

$ DATABASE_URL="postgresql://u:p@127.0.0.1:5999/x?connect_timeout=2" npx prisma db pull

Run it against a dev environment to trigger P1001 on purpose and test your error handler.

Prevent

Add a healthcheck and depends_on for the db container.
Allowlist CI runner and server egress IPs.
Log the DATABASE_URL host (never the password) on boot.

FAQ

P1001 works locally but fails in GitHub Actions — why?

The runner cannot reach a private database, or the DB allowlist excludes GitHub IPs. Use a service container for tests or a self-hosted runner in the VPC.

Does P1001 mean my password is wrong?

No. P1001 happens before authentication; wrong credentials produce P1000.

Do I need sslmode=require?

Most managed providers reject non-TLS connections. A rejected TLS negotiation can surface as P1001 or P1011 depending on the provider.

Related errors

Last verified 2026-10-17 · Source: Prisma error reference P1000–P6010 · Official docs ↗ · ~9,900 searches/mo