FAQ

What is Wharfbase? A web app you run next to your Docker containers. It finds every database on the server by itself (PostgreSQL, MySQL, MariaDB, MongoDB, Redis, SQLite and, on Pro, ten more engines), shows what uses each one and what’s wrong with it, and opens them in a browser and a SQL editor.

Is it free? The Community plan is free, with no key: one server, 5 connected databases per server, 3 users. Pro and Team raise the limits and add features: multi-server, backups, permissions, SSO. See Plans and licenses.

Does it change my containers? No. It reads through the socket-guard, which only allows reads plus a few narrow actions:

joining a network, for Wharfbase itself;
copying a file out of a container, for SQLite snapshots;
optionally, short-lived helper containers for backups and wb shell;
optionally, relays, if you’d rather Wharfbase didn’t join your databases’ networks: small containers that forward one port each (see Relays).

It never restarts, stops or edits your containers.

What does it send out? Nothing about your server, unless you choose to:

The update check, on by default, asks the license server once a day for the latest version number. It sends nothing with the request, not even your version. Turn it off under Settings → General.
A paid license key or a trial checks in with the license server once a day: the license, a random instance ID, the version and three counts (servers, databases, users). Nothing from your databases.
Telemetry is off unless you turn it on. Then it sends one anonymous report a day (version, plan, counts, databases per engine), and Settings → General shows it to you first.

The full list: What Wharfbase reads and sends.

Where are my database passwords? Encrypted with AES-256-GCM in Wharfbase’s own database, with a master key kept outside the data volume. Only if you choose Remember; otherwise they’re kept in memory for the session. See Security model.

Can it break my production database? Databases tagged production open read-only, and writing needs an audited, time-limited unlock (or an approval, on Team). Read-only connections are enforced by the database where the engine allows it. For a hard guarantee, connect with a read-only database user: each engine’s page shows how to create one.

Does it need root? No. Wharfbase runs as uid 10001 with no capabilities. The socket-guard holds the Docker socket for it. The optional host scan adds one capability, to read root-only files, and mounts / read-only.

Docker Desktop, Podman, rootless Docker?

Docker Desktop and Colima: they work; Wharfbase reaches databases over their Docker networks as usual.
Rootless Docker: works; the installer finds the socket.
Podman: its Docker-compatible socket should work, but it isn’t tested yet.

Kubernetes? Yes: run Wharfbase in the cluster with the manifest or the Helm chart, and it finds the databases in your pods through a read-only service account. See Kubernetes.

Can it keep running if a host goes down? On Team, yes: keep the hub’s data in PostgreSQL and run a second hub next to it as a standby. It takes over within seconds when the first one stops. See High availability.

Databases that aren’t in Docker?

The host scan finds databases installed on the server itself.
An admin can add any host and port through the API (POST /api/v1/databases/manual).

Without internet access?

Wharfbase itself runs offline.
Paid keys check in with the license server and have a 14-day grace period when they can’t.
Keys issued for offline use need no contact at all.

How is it different from Adminer, phpMyAdmin or DbGate? Those are clients: you give them a host, a port and a password. Wharfbase starts from the server:

it finds the databases;
it knows which container uses which database;
it checks them for exposed ports, default passwords and end-of-life versions;
it joins the right network to reach them.

The data browser and SQL editor come on top.

How do I report a security problem? Privately, as SECURITY.md explains.