libredb/libredb-studio repository overview

⁠LibreDB Studio

The modern, AI-powered, open-source web-based SQL IDE for cloud-native teams.

Query PostgreSQL, MySQL, SQLite, libSQL, DuckDB, Oracle, Db2 LUW, SQL Server, MongoDB, Redis, Couchbase, ClickHouse, Apache Druid, Elasticsearch, OpenSearch, Trino, Apache Cassandra, Prometheus, InfluxDB, Apache Kafka, etcd, Neo4j, Milvus, Qdrant and Oxia from your browser, with AI query assistance, RBAC and OIDC SSO.

⁠Quick start

docker run \
  --name libredb-studio \
  -p 3000:3000 \
  -e [email protected] \
  libredb/libredb-studio:latest

Open http://localhost:3000⁠. No password is set above, so the first start generates one and prints it with docker logs libredb-studio. To choose your own instead, add -e ADMIN_PASSWORD=... and -e JWT_SECRET=... — the secret has to be at least 32 characters.

⁠Docker Compose

services:
  libredb-studio:
    image: libredb/libredb-studio:latest
    ports:
      - "3000:3000"
    environment:
      ADMIN_EMAIL: [email protected]
      STORAGE_PROVIDER: sqlite                 # persist on the volume below
      STORAGE_SQLITE_PATH: /app/data/libredb-storage.db
    volumes:
      - libredb-data:/app/data
    restart: unless-stopped
volumes:
  libredb-data:

A ready-to-use, fully-commented compose file is in the repo: docker-compose.example.yml⁠.

⁠Reaching your databases from inside the container

localhost in the connection dialog means this container, not your machine. A database on the host, or in another container, is not there, so a connection that works from a terminal fails here, and it fails as a timeout rather than as anything that mentions the host.

Pick whichever fits how the database runs:

Two things worth knowing before you pick:

• The port inside a network is the engine's own, not the one you published. A compose file that publishes 9201:9200 to dodge a collision on the host is still 9200 between containers, and a Postgres published on 5433 is still 5432 there.
• host.docker.internal resolves by itself only on Docker Desktop. On Linux the --add-host=host.docker.internal:host-gateway flag above is what creates it.

The network route is the one to prefer for a real deployment: put Studio and its databases on one network, address them by name, and nothing depends on a published port existing. docker-compose.yml⁠ in the repository is that shape.

⁠Image tags

Every one of those tags is published on three bases, and the suffix is appended to the tag it would otherwise be (0.16.2, 0.16.2-alpine, 0.16.2-alpine-slim; likewise latest-alpine, dev-alpine):

-alpine is the same product as the default image. -alpine-slim is the only variant that trades features for size: opening a DuckDB connection on it answers with a message naming the tags that do ship that driver. Oracle Thick mode needs Oracle Instant Client, which has no musl build, so it stays on the default tag. None of the three carries the application source.

• Architectures: linux/amd64 and linux/arm64 as a multi-arch manifest for latest, X.Y.Z, main and their sha- tags. Preview builds from feat/** / fix/** branches (dev and their sha- tags) are linux/amd64 only: CI has no native arm64 runner for this job.
• Primary registry: ghcr.io/libredb/libredb-studio (GitHub Container Registry), where CI publishes with build provenance. This Docker Hub repository is a mirror of the identical multi-arch image; the libredb namespace is in the Docker-Sponsored Open Source⁠ programme, so docker pull libredb/libredb-studio is rate-limit-free and needs no account.

⁠Supported databases

Twenty-six external engines share one interface. The twenty-seventh row is the embedded LibreDB store: it ships inside the image, not as a server you reach.

Read-only where the engine is. Druid, Elasticsearch and OpenSearch have no UPDATE and no CREATE TABLE anywhere in their grammar, so inline editing and DDL are reported as unsupported instead of failing when used. Prometheus, InfluxDB, Apache Kafka and Oxia are read-only too: Studio calls only read APIs.

⁠Engines with no provider of their own

Twenty-eight further engines speak the wire protocol of one of the twenty-six drivers above, so they connect through it unchanged: pick that driver in the connection dialog. Each was measured against a real instance, and how much worked is recorded per engine.

Details, probed versions and each caveat: docs/providers/README.md⁠.

⁠Key features

• Professional SQL IDE — Monaco editor (VS Code engine), schema-aware autocomplete, multi-tab workspace, Visual EXPLAIN.
• Interactive ER diagrams — real FK edges, cardinality, auto-layout (ELK.js), PNG/SVG export.
• Schema diff & migration — compare snapshots/connections and auto-generate migration SQL.
• Read-only database agent — state an objective, and the run drafts SQL, reads the results and composes a report whose claims cite them. Three workflows (investigate / optimize / assess), a visible statement-and-time budget, and writes refused before the database is reached. Agent mode executes on PostgreSQL, SQLite, DuckDB and SQL Server only — the four engines with a database-native read-only execution profile; anywhere else a statement-sending run is refused at the start, with engine-unsupported. Plan mode is toolless, runs no statement of yours, and is grounded in your own schema on every engine. Standalone image only. Guide⁠ · What leaves the machine⁠.
• Model-backed helpers — query safety analysis, EXPLAIN-in-plain-English, AI-generated schema docs, data-profile summaries. Gemini / OpenAI / Ollama / custom; with no LLM_* variables at all, no AI call is made. A key is required for Gemini and OpenAI only: Ollama and a custom endpoint count as a configured model without one.
• Pro data grid — virtualized millions of rows, inline editing, per-column filters, pivot table, CSV/JSON export.
• Data visualization — 8 chart types with aggregation and saved-chart dashboards.
• Data privacy & masking — automatic sensitive-column detection, RBAC-enforced masking, export protection.
• Auth & SSO — local email/password or OIDC (Auth0, Keycloak, Okta, Azure AD, Zitadel) with PKCE and role mapping.
• DBA toolkit (admin) — live monitoring dashboard, threshold alerts, full audit trail, and one-click maintenance in each engine's own terms (VACUUM/ANALYZE/REINDEX on PostgreSQL, OPTIMIZE TABLE on MySQL, and nothing offered where an engine has no maintenance statement to run).

Interactive ER diagrams with real foreign-key edges and auto-layout.

⁠Environment variables

Health check endpoint: GET /api/db/health · Container HTTP port: 3000.

⁠Deploy

• Kubernetes (Helm) — oci://ghcr.io/libredb/charts/libredb-studio · Artifact Hub⁠
• CapRover — built into the official One-Click Apps catalog: Apps → One-Click Apps/Databases → search LibreDB Studio. No third-party repo to add.
• PaaS — one-click buttons for Koyeb & Render in the GitHub README⁠.

⁠Links

• Project website: https://libredb.org⁠
• Source & docs: https://github.com/libredb/libredb-studio⁠
• Contributing: CONTRIBUTING.md⁠ — how to open an issue, run the test suite and send a pull request, alongside the Code of Conduct⁠
• Live demo: https://app.libredb.org⁠
• DeepWiki docs: https://deepwiki.com/libredb/libredb-studio⁠
• License: MIT

⁠Star the project

LibreDB Studio is open source under the MIT license and free to use, with no paid tier gating any feature on this page. If it is useful to you, a star on GitHub is the clearest signal that the work is worth continuing.

_{This page mirrors DOCKERHUB.md⁠ in the GitHub repository.}