diff --git a/docker/mysql-client/Dockerfile.j2 b/docker/mysql-client/Dockerfile.j2
new file mode 100644
index 0000000..ca06797
--- /dev/null
+++ b/docker/mysql-client/Dockerfile.j2
@@ -0,0 +1,6 @@
+FROM {{ image_spec("base-tools") }}
+MAINTAINER {{ maintainer }}
+
+RUN apt-get update \
+    && apt-get install -y --force-yes --no-install-recommends mysql-client \
+    && apt-get clean
diff --git a/service/actions/backup-db.yaml b/service/actions/backup-db.yaml
new file mode 100644
index 0000000..76124f3
--- /dev/null
+++ b/service/actions/backup-db.yaml
@@ -0,0 +1,13 @@
+actions:
+  - name: backup-db
+    image: mysql-client
+    dependencies:
+      - {{ serivce.database }}
+    parameters:
+      - key: db
+        default_value: null
+    command: /opt/ccp/bin/backup-db.sh
+    files:
+      - path: /opt/ccp/bin/backup-db.sh
+        content: backup-db.sh.j2
+        perm: "0700"
diff --git a/service/files/backup-db.sh.j2 b/service/files/backup-db.sh.j2
new file mode 100644
index 0000000..3d86979
--- /dev/null
+++ b/service/files/backup-db.sh.j2
@@ -0,0 +1,12 @@
+#!/bin/bash
+
+set -ex
+
+DB_NAME="{{ action_parameters.db }}"
+BACKUP_FILE="/var/ccp/backup/${DB_NAME}/backup-$(date "+%Y%m%d%H%M%S").sql"
+
+mkdir -p "$(dirname ${BACKUP_FILE})"
+
+mysqldump {% if db.tls.enabled %} --ssl-mode REQUIRED {% endif %} -h {{ address(service.database) }} \
+    -uroot -p{{ db.root_password }} \
+    --single-transaction --routines --triggers "${DB_NAME}" > "${BACKUP_FILE}"