bzynchub/nextsql repository overview

⁠Overview

NextSQL⁠ is a native, encrypted-by-default multimodel database. Relational SQL, binary JSON, vector search, full-text search, and geospatial types share one storage engine, one WAL, one MVCC transaction model, and one query optimizer. It is not a PostgreSQL, MySQL, MongoDB, or Elasticsearch compatibility layer.

bzynchub/nextsql is the official image. It is a static Go runtime (FROM scratch) with three binaries — nextsql, nextsqld, and the PID-1 wrapper nextsql-entrypoint — and no shell, package manager, or libc userland. docker exec can run /usr/local/bin/nextsql; it cannot run sh.

The process runs as the unprivileged nextsql user (uid 10001). Database files persist in /var/lib/nextsql. The root unlock key lives on a separate /run/secrets volume and is never placed in the database volume. Pages, WAL, and UNDO stay encrypted by default.

Images are multi-arch (linux/amd64, linux/arm64). Only a git release tag (v*.*.*) publishes an image. Pin an explicit version — there is no latest tag:

docker pull bzynchub/nextsql:0.0.1

The current release is 0.0.1 (preview). The default listen address is 0.0.0.0:7210, which is off loopback, so TLS 1.3 is required. First start also requires a bootstrap administrator (NEXTSQL_SERVER_USER plus a password file or NEXTSQL_SERVER_PASS); without them the entrypoint exits 64.

mkdir -p secrets
umask 077
printf 'change-this-development-password\n' > secrets/app-password
openssl req -x509 -newkey rsa:3072 -nodes -days 30 \
  -keyout secrets/server.key -out secrets/server.crt \
  -subj '/CN=localhost' -addext 'subjectAltName=DNS:localhost'
chmod 644 secrets/app-password secrets/server.key secrets/server.crt

docker run -d --name nextsql -p 7210:7210 \
  -v nextsql-data:/var/lib/nextsql \
  -v nextsql-keys:/run/secrets \
  -v "$PWD/secrets/app-password:/run/bootstrap/app-password:ro" \
  -v "$PWD/secrets/server.crt:/run/tls/server.crt:ro" \
  -v "$PWD/secrets/server.key:/run/tls/server.key:ro" \
  -e NEXTSQL_SERVER_USER=app \
  -e NEXTSQL_SERVER_PASSWORD_FILE=/run/bootstrap/app-password \
  -e NEXTSQL_TLS_CERT=/run/tls/server.crt \
  -e NEXTSQL_TLS_KEY=/run/tls/server.key \
  bzynchub/nextsql:0.0.1

On first start the entrypoint runs nextsql setup into the data volume and writes nextsql.conf; later starts reuse that directory and pass the file to nextsqld with --config. Set NEXTSQL_PROFILE=production to apply the fail-closed production preflight (administrator required, unlock key off the data volume, TLS 1.3 off loopback).

Do not put the root key in the data volume. Take a nextsql backup before removing volumes. Compose, a three-node Raft cluster, Podman, and the full environment-variable reference are in docs/docker.md⁠ and ENV.md⁠.

• Source: github.com/bzync/nextsql⁠
• Docs: nextsql.bzync.com⁠
• License: MIT⁠