CloudBeaver

Last reviewed Sep 13, 2026 · 962 words

One container on port 8978 gives every person on your team a browser tab that can query PostgreSQL, MySQL, MariaDB, SQLite, SQL Server, Oracle, ClickHouse, and a long list of others, with the same editor, autocomplete, and data grid that DBeaver desktop users already know. That is CloudBeaver, Apache-2.0, 5,118 stars, from the DBeaver team. It is the right tool when several people need database access through a browser and you want one place to define who can see which connection. It is overkill when one person needs to poke at one database, and the free edition has a line through it that you should know about before you build on it.

Setup is a single image and a volume you must keep

services:
  cloudbeaver:
    image: dbeaver/cloudbeaver:latest
    ports:
      - "8978:8978"
    volumes:
      - ./workspace:/opt/cloudbeaver/workspace
    restart: unless-stopped

First visit runs a wizard: name the server, create the admin user, decide whether anonymous access is allowed (say no), and optionally pre-define connections. Everything it knows lives in /opt/cloudbeaver/workspace, including the internal H2 database that stores users, roles, and saved connections; back that directory up or lose the lot on an image upgrade. Behind a reverse proxy it wants WebSocket support enabled, because the editor and the data grid stream results over a socket rather than polling; Caddy handles it by default, Nginx needs the upgrade headers.

The catalogue's 1 GB minimum is the JVM at rest. The backend is Java and the memory grows with result sets and open sessions, so a team of 10 running real queries wants 2 GB and a JVM heap flag to stop it eating the box.

Shared connections versus private ones is the core feature

Administrators define connections in the admin panel and assign them to teams or users; those users log in and see the connections they are allowed, with credentials already filled or prompted per user. Individual users can also create private connections that only they see, if you allow it. Credential storage can be per-connection (shared) or per-user, and the latter is what you want for anything audited: the database sees a real user, not a shared service account. This is the difference between CloudBeaver and dropping Adminer on a server. Adminer is one PHP file, connects to anything, and has no concept of managed connections or roles; whoever can reach it and knows a password gets in.

For a team that wants a controlled read-only window into production, define the connection with a read-only database role, mark it read-only in CloudBeaver as well, and give it to the whole team. That setup has saved me from more than one accidental UPDATE without a WHERE.

The free-versus-paid line, drawn plainly

The community edition you get from the public image covers the SQL editor, data viewer and editor, ER diagrams, data export and import in the usual formats, user and team management with local accounts, and a large driver set. The paid Enterprise and Team editions add single sign-on (SAML, OpenID, LDAP), NoSQL and cloud-warehouse drivers, query history and auditing across users, and centralised connection management across several servers. So the free edition will not log you in with Authentik natively, and if your requirement is MongoDB in the browser this is not the free tool for it. Local user accounts are fine for a homelab or a small team; a company that needs SSO for compliance should price the Team edition against the pain of maintaining local accounts.

Where it fits among the browser database tools

Adminer for a single database and a single operator, or as the emergency door on any server; it is 500 KB and never needs updating. phpMyAdmin if you are MySQL-only and your users already know it. NocoDB if the people who need access are not SQL people and want a spreadsheet view with forms. SQLPad if the need is shared saved queries and charts rather than schema browsing. CloudBeaver sits above all of them when the need is "real SQL editor, many engines, many users, who-can-see-what." Nothing else free in the dev tools category covers that combination as well. Anyone eyeing DataGrip's licence cost for a team should read the DataGrip alternatives page; CloudBeaver is the closest free browser equivalent, and DBeaver desktop is the closest free desktop one.

Operating it without surprises

Pin the image tag rather than tracking latest, because the workspace format has changed between releases and a surprise upgrade is a bad way to find that out. Put it behind TLS with the admin login rate-limited; a database tool with a login page is a high-value target. Do not expose it to the internet at all if the databases it can reach are production; put it on Tailscale or behind your VPN and let the reverse proxy stay internal. And rotate the admin account's password out of the wizard default the same day, because it is the one account that can see every stored credential.

What I'd do

For a homelab with 3 databases and one operator, Adminer, and not another thought. For a team of 4 or more who need to query several engines through a browser with proper per-user access, CloudBeaver community edition on a pinned tag, 2 GB of memory, shared read-only connections to production and private connections for dev, reachable only over the VPN. I would accept local accounts rather than pay for SSO until the team passed about 20 people, and I would keep DBeaver desktop installed for the heavy migration jobs the browser version is not built for.