I got tired of opening ports just to query my own database

Every time I spun up a managed Postgres, the workflow was identical: database ready in 40 seconds, then open a port, dig an SSH tunnel, or install a desktop app on whichever machine I happened to be at.

So I built something that deploys next to the data, not onto your laptop.

github.com/libredb/libredb-studio

What it does

A self-hosted SQL IDE in a container. You reach it from any browser. Nothing faces outward.

docker run -d -p 3000:3000 ghcr.io/libredb/libredb-studio:latest

Ten plus engines behind one interface: PostgreSQL, MySQL, Oracle, SQL Server, SQLite, MongoDB, Redis, Couchbase, ClickHouse, Druid... Same ER diagrams, same schema diff, same Monaco editor across all of them.

The things that actually matter day-to-day:

• Schema diff with auto-generated migration SQL
• Interactive ER diagrams (auto-layout, PNG/SVG export)
• NL2SQL with any LLM — Gemini, OpenAI, or local Ollama
• ORM code generator (TypeScript, Prisma, Go, Python, Java)
• OIDC SSO — in the MIT build, not behind a paywall

53 seconds demo:

8 months in. Happy to answer questions about any design decision; drop them below.

Comments

[Mads Hansen]

Nice project and the “deploy next to the data” direction makes sense. One correction worth making explicit: docker run -p 3000:3000 normally publishes the UI on all host interfaces, not only localhost. So “nothing faces outward” depends on the surrounding network, firewall, and proxy configuration.

For a single-host local deployment I’d show -p 127.0.0.1:3000:3000. For shared access, put it behind TLS/OIDC on a private network and treat the browser UI as a privileged database control plane.

I’d also split credentials by capability: metadata/read-only query role by default, with schema-diff apply or migration execution behind a separate role and explicit approval. Add statement timeout, row/byte limits, audit identity, CSRF/session hardening, and test that the container cannot reach databases it was not configured for.

A web IDE removes laptop tunnels; it does not remove the need to define the network and database trust boundaries.