CloudDM – ClouGence's Open-Source Database Development and Governance Platform

1. What Is CloudDM

CloudDM is an enterprise-grade database development and governance platform open-sourced by the ClouGence team. It is not a traditional standalone database management tool, but a unified collaboration platform that integrates data querying, SQL review, permission control, data masking, and CI/CD integration. Supporting 30 data sources—including MySQL, PostgreSQL, ClickHouse, Redis, StarRocks, and cloud databases on Alibaba Cloud, AWS, and Azure—CloudDM provides DBAs, developers, and operations teams with a full-lifecycle database governance solution from development to production, addressing industry pain points such as multi-tool switching, fragmented permissions, and non-standard workflows.

Image source: Official article

Technical positioning and domain: CloudDM sits at the intersection of database management and DevOps. It positions itself as a one-stop "database development and governance" solution. Unlike pure database clients (such as Navicat) or tools focused solely on SQL review, its core value lies in connecting development, operations, and security compliance into a unified collaborative loop.

Development background: The platform was developed and open-sourced by the ClouGence team, which has long focused on database infrastructure. The team deeply understands the fragmentation, high security compliance costs, and low collaboration efficiency enterprises face in database management. CloudDM aims to empower a broader developer and enterprise audience through open source, lowering the barrier to building internal database governance platforms.

Core value: CloudDM addresses the "three hard problems" of enterprise database management: "hard to query" (multiple data sources and tool switching), "hard to change" (high SQL release risk and non-standard processes), and "hard to govern" (coarse permission granularity and missing audit trails). Through a unified entry point, automated review, and fine-grained permission models, it significantly improves R&D efficiency, reduces production incident risk, and meets strict compliance audit requirements in finance, internet, and other industries.

Technical characteristics: CloudDM's architecture highlights include a separated front-end/back-end Web console, a built-in SQL review engine with 54 rules, and a dual-layer RBAC (role-based access control) permission model. Its rule engine supports custom extension via Rule Script, with permission granularity down to the column level—industry-leading fine-grained security control. Docker one-click deployment and Kubernetes cluster support also greatly reduce the operational cost of private deployment.

2. Key Features

• Unified data querying and object management: Provides a Web-based SQL console supporting seamless switching across 30 data sources. Includes syntax highlighting, intelligent suggestions, and execution plan analysis. Integrates a visual database object editor for creating, modifying, and deleting databases, tables, columns, indexes, views, stored procedures, and more—consolidating daily development and operations in one interface.

• Automated SQL change governance: Built-in 54-rule SQL review engine covering static analysis of DDL and DML statements, automatically blocking high-risk operations (such as full table scans without indexes or large-table DDL changes). Supports custom rule extension via Rule Script, with rule scope configurable down to instance, database, table, or column. Integrates with Feishu, DingTalk, WeCom, and other IM tools for automated approval and notification workflows.

• Fine-grained RBAC permission model: Uses a decoupled dual-layer RBAC model separating "functional permissions" from "resource permissions." Functional permissions control which menus and operations users can access (e.g., "query" or "change"), while resource permissions specify which instance, database, schema, table, or even column they can access. DDL and DML permissions can be granted separately, meeting enterprise requirements for strict separation of query and change privileges.

• Column-level data masking: Built-in 5 masking rules (phone numbers, ID numbers, email, etc.) plus support for custom masking algorithms. Masking applies at column level and executes dynamically on query results, supporting masking of individual values or entire rows. Provides "last-mile" security protection for sensitive production data access, effectively preventing data leakage.

• Unified identity authentication and SSO integration: Supports standard enterprise identity protocols including OpenLDAP, Windows AD, and OIDC, plus SSO with DingTalk, Feishu, WeCom, and other mainstream domestic IM tools. Enables seamless integration into existing account systems for unified identity lifecycle management, avoiding the chaos of multiple systems and passwords.

• CI/CD integration and automated release: Supports Git Push, WebHook, and HttpCall to trigger database change workflows. Developers push SQL scripts to a designated Git repository to automatically trigger CloudDM's check, approval, and execution pipeline. Each pipeline node (check, approval, execute) can be independently enabled or disabled, flexibly adapting to different team release strategies—key capability for database GitOps.

• Comprehensive audit and compliance records: Provides operation audit (recording all user actions on the platform) and SQL execution audit (recording all SQL executed through the platform). Supports manual execution, immediate execution, and scheduled execution modes, ensuring every data access and change is traceable—meeting SOX, PCI-DSS, and other regulatory audit requirements.

• Heterogeneous DDL conversion: Supports DDL conversion from 18 source data source types to 12 target databases including MySQL, ClickHouse, Dameng, Oracle, and PostgreSQL, covering 192 conversion scenarios. Highly valuable for database migration, cloud migration, or heterogeneous database synchronization, significantly reducing manual DDL writing and error risk.

3. How to Use

1. Environment requirements and one-click deployment: Ensure the server has Docker Engine installed (version 20.10+ recommended). Run the following Docker command to start the CloudDM server in about 10 seconds:

   docker run -d --name cgdm-alone -p 8222:8222 bladepipe/cgdm-alone:3.0.7
   

   Note: Users in China experiencing slow image pulls can configure Alibaba Cloud mirror acceleration.

2. Access console and initialization: Open a browser and visit http://<server-IP>:8222. First visit enters the initialization wizard to set admin credentials and complete basic configuration. The system guides you to create the first team and project.

3. Connect data sources: Navigate to "Data Source Management" and click "Add Data Source." Select database type (e.g., MySQL), fill in connection details (host, port, username, password, database name). CloudDM supports SSH tunnel or proxy connections to internal databases without exposing public ports. Save after successful connection test.

4. Configure permissions and roles: In "Permission Management," create roles (e.g., "Developer Query User," "DBA Admin"). First assign functional permissions (e.g., "Query Console" menu), then resource permissions (specify accessible database instances, databases, tables, and columns requiring masking). Finally, add users to the role to bind permissions.

5. Configure SQL review rules: Enter the "Security Rules" module. The system enables 54 built-in rules by default. Enable or disable specific rules per team standards and adjust policy ("warning" or "block"). Click "Custom Rules" to write new review logic using Rule Script, such as blocking SQL statements in specific formats.

6. Execute queries or submit changes:

   • Query: In the "Query Console," select an authorized data source, write SQL, and execute. The system automatically applies masking rules to sensitive columns.
   • Change: Submit a "ticket" with uploaded or written SQL change scripts. The system automatically triggers the rule engine for checking. If checks pass, execute automatically or manually per configured approval workflow (e.g., DBA approval).

7. Integrate enterprise IM and CI/CD:

   • IM integration: Configure DingTalk, Feishu, or WeCom Webhook addresses in "System Settings." The platform automatically pushes notifications when tickets await approval or execution fails.
   • CI/CD integration: Configure Git repository Webhook addresses in "Pipeline" settings. When developers submit PRs containing SQL scripts, CloudDM automatically triggers the change workflow, achieving automated database changes from code commit to execution.

4. Pros and Cons

5. Comparison with Similar Tools

Selection advice:

• For enterprises seeking comprehensive features, diverse data sources, and extreme compliance requirements for permissions and masking (finance, large internet companies): CloudDM is the top choice. Its 30 data source support, column-level permissions and masking, and fully open un-gated features make it an ideal foundation for enterprise database governance platforms. Archery and Yearning have clear gaps in permission granularity and data source breadth.
• For teams primarily on MySQL with smaller scale already deeply embracing GitOps: Bytebase may be more attractive. Its native GitOps integration and clean UI excel in specific scenarios. Note that advanced features (such as masking) belong to the commercial edition, and data source coverage is narrower than CloudDM. CloudDM also supports GitOps via HttpCall, though integration depth and native experience differ slightly.

6. Editor's Take

CloudDM marks a new stage in the open-source database governance platform space. Rather than competing on a single feature point with existing tools, it adopts a "platform" mindset—organically integrating query, change, permission, masking, audit, and CI/CD modules into a complete "database development and governance" loop. Its technical innovation lies in two areas: first, an extremely fine-grained permission model that pushes control from common database/table level down to column level with DDL/DML separation—rare in open-source projects, directly comparable to commercial products; second, a highly flexible rule engine supporting custom extension via Rule Script, making the platform a programmable, adaptable "living" system rather than a rigid rule collection.

From practical value, CloudDM directly addresses the core enterprise database management challenge—balancing security and efficiency. Automated review reduces change risk; fine-grained permissions and masking protect data security; unified entry and CI/CD integration improve R&D efficiency. Docker one-click deployment and comprehensive data source support greatly lower adoption and operational costs.

Target audience: CloudDM's core users are enterprise DBA teams, database operations personnel, and backend developers who frequently work with databases. Its value is especially prominent for industries requiring compliance audits such as finance, internet, and e-commerce.

Future potential: CloudDM has enormous growth potential. As its community ecosystem matures, more Rule Script-based review rules and plugins will emerge. If it further strengthens SQL performance analysis and intelligent optimization recommendations and deepens support for more domestic databases (such as TiDB and OceanBase), it could become standard infrastructure for enterprise database governance in China.

Recommended rating: ★★★★☆ (4.5/5)

Rating basis:

• Feature completeness (5/5): Comprehensive coverage with no commercial feature gating—industry leading.
• Technical innovation (4.5/5): Permission model and rule engine design are highly innovative, though static analysis capability still has room to evolve.
• Usability (4/5): Docker deployment is extremely simple, but advanced feature configuration has a learning curve.
• Ecosystem and community (3.5/5): As an emerging project, community scale and documentation richness need strengthening, but the open-source license is friendly with strong potential.

7. Use Cases

• Enterprise unified database governance portal: Provides DBAs and development teams a unified data query entry and change management platform. DBAs no longer need multiple clients for different databases; developers access authorized data sources through a browser for secure, controlled SQL queries and changes—eliminating inefficient multi-tool switching.

• SQL review and compliance governance pipeline: Embeds CloudDM's rule engine into database change release workflows. Any DDL or DML statement must pass automated rule engine checks before execution, blocking high-risk operations (such as queries without indexes or schema modifications). Combined with approval workflows and operation audits, forms a complete compliance governance loop meeting financial and securities industry regulatory requirements.

• Production sensitive data security protection: Configure column-level masking rules for sensitive columns such as user phone numbers, ID numbers, and bank card numbers in production databases. When non-core operations staff or third-party auditors query through CloudDM, the system automatically returns masked data (e.g., phone showing as 138**0000)—meeting business query needs while fundamentally preventing sensitive data leakage.

• DevOps automated database change pipeline: Developers submit database change scripts (such as ALTER TABLE statements) to specific Git branches. Configured Git Webhooks automatically trigger CloudDM's review workflow. After approval, changes execute on target databases with results fed back to Git—achieving GitOps and full-process automation for database changes, greatly improving release efficiency and reliability.

• Multi-tenant/multi-project permission isolation: In SaaS providers or large enterprises where different tenant or project team data resides in different databases or tables on the same instance. CloudDM's fine-grained RBAC model creates independent roles per team with precise authorization to only their databases, tables, or columns—strict data access boundary isolation ensuring multi-tenant data security.

8. FAQ

Q: Is CloudDM 100% free? Are there hidden charges?
A: Yes. CloudDM uses the Apache 2.0 open-source license; code and features in the GitHub repository are 100% free and fully open. The official commitment is no enterprise edition feature gating—all advanced features (permission control, data masking, CI/CD integration) are free. The only potential charges are commercial support services or SaaS hosted versions, which are not required to use the open-source edition.

Q: Can CloudDM connect to internal network databases? Must public ports be exposed?
A: Yes. CloudDM provides SSH tunnel and proxy connections to access internal databases. No public ports need to be opened on database servers—only ensure CloudDM servers can reach internal databases via SSH or proxy. This greatly improves deployment security, especially for cross-datacenter or hybrid cloud-local scenarios.

Q: How do I customize SQL review rules? Do I need programming skills?
A: CloudDM custom rules use its proprietary Rule Script—a lightweight scripting language designed for SQL review. It's simpler than full programming languages (Java, Python), mainly involving rule name definition, match patterns (exact/prefix/suffix/contains), match objects (table names, column names), and triggered behavior (warning/block). Official documentation provides detailed syntax and examples; DBAs or developers with SQL foundation can learn with relatively low cost.

Q: How is CloudDM's performance? Can it support large enterprise concurrent access?
A: CloudDM supports standalone and Kubernetes cluster modes. For large enterprises, cluster deployment is recommended for horizontal scaling and high availability to support high concurrent access. For data queries, CloudDM doesn't store business data—all query requests forward to target databases, so query performance depends primarily on target database performance. CloudDM mainly adds minimal compute overhead for permission validation, SQL review, and result masking—typically millisecond-level in optimized architecture.

Q: I use domestic databases like Dameng or KingbaseES. Does CloudDM support them?
A: Yes. CloudDM explicitly supports Dameng (DM) database, and the "DDL conversion" feature supports converting other data source DDL to Dameng syntax. For KingbaseES and other domestic databases compatible with PostgreSQL or Oracle protocols, connection and adaptation is typically possible through PostgreSQL or Oracle data source types.

9. Project Links

• GitHub repository (open-source code): https://github.com/ClouGence/open-cdm
• Official website (documentation and community): https://www.cdmgr.com/