mrkeyoor.com_
Wed 16 Sept 05:27 UTC
Dataevaluationupdated 27 Aug 2026

duckdb review

DuckDB is an in-process analytical SQL database that runs inside an application or from a command-line client. It lets analysts query local files such as CSV and Parquet directly, or persist data in a database file, without operating a separate database server.

+180stars / 7d
Verdict

Our api_spec/ install took 24 seconds and 37 MB, but pytest found 0 tests, so that clean build is evidence about the C API generator rather than proof that the DuckDB engine passed its suite. DuckDB is an excellent default for local analytical SQL over files or in-process data, provided one process owns writes. Choose a server database for multi-user remote access, transactional traffic, or several writer processes.

We ran it

Lab card: what happened when we ran duckdbScreenshot of duckdb (www.duckdb.org)
Install✓ · 24s36 packages · 37 MB
Build✓ · 4s
Tests✗ · 5s0 passed · 0 failed of 0 (pytest)
Known vulns0(pip-audit)
Repo15242 files~1,214,802 lines of source · 249.2 MB · 27 CI workflows · tests dir

Answers from our run

Does duckdb build from source?

Dependencies installed in 24 seconds (36 packages), and the build succeeded in 4 seconds. We cloned commit 044a04a into a clean Debian container with 3 CPUs and no project-specific setup.

Do duckdb's tests pass?

Yes: 0 of 0 passed when we ran the project's own test command (pytest). Some failures need services or credentials a bare container does not have.

Does duckdb have known vulnerabilities in its dependencies?

pip-audit found none in the dependency tree at the time of our run.

Who should not use duckdb?

Applications that need several processes writing the same database file: the concurrency guide limits read-write access to one process.

What are the alternatives to duckdb?

SQLite, ClickHouse, Apache DataFusion. Our api_spec/ install took 24 seconds and 37 MB, but pytest found 0 tests, so that clean build is evidence about the C API generator rather than proof that the DuckDB engine passed its suite.

Setup4/5Released clients are simple; our 24-second api_spec install passed
Docs5/5SQL, clients, file formats, extensions, and internals are documented
Community5/540,686 stars with pushes and issue activity in August 2026
Maturity5/5v1.5.5 is active with a large engine and client ecosystem

Discussed on

  1. hnDuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware395 points
  2. hnDuckDB: SQLite for Analytics290 points
  3. hnShow HN: Open-source, browser-local data exploration using DuckDB-WASM and PRQL227 points
  4. hnpg_duckdb: Splicing Duck and Elephant DNA186 points
  5. hnPRQL as a DuckDB Extension105 points

Who it’s for

Data analysts who want SQL over local CSV, Parquet, pandas, or R data frames.
Application developers who need analytical queries inside a Python, R, Java, C++, or browser process.
Data engineers building local transforms, tests, or embedded reporting without a database service.
Researchers who value portable database files and a broad SQL dialect.

Who it’s NOT for

Applications that need several processes writing the same database file: the concurrency guide limits read-write access to one process.
User-facing transactional systems built around many small concurrent updates: DuckDB is designed for analytical workloads, and same-row updates can conflict even within one process.
Teams expecting a network database with accounts and a server endpoint: DuckDB is embedded, so remote access and authorization belong to the host application.
Buyers seeking a full engine test result from our run: our measured Python project was api_spec/, and pytest discovered 0 tests rather than exercising the C++ database suite.
Workloads that assume every HTTP data source handles range requests correctly: open issue 25028 documents a public API whose nonstandard 206 replies make httpfs fail.

Setup reality

Our run targeted the Python project in api_spec/. Installation succeeded in 24 seconds with 36 packages and 37 MB on disk, then its build passed in 4 seconds. Pytest exited 5 after 5 seconds because it found 0 tests. Pip-audit reported 0 known vulnerabilities. These figures do not describe compiling or testing the C++ engine.

Most users install a released CLI or language package and need no service credentials. Remote files or extensions may require network access and cloud secrets. Source development of the database itself needs CMake, Python 3, and a C++17 compiler, followed by DuckDB's own make unit or make allunit targets.

DuckDB permits one read-write process per database file, while multiple processes may open it read-only. Extensions add capabilities and their own compatibility surface. Memory, threads, temp storage, and host-process failure handling remain application responsibilities because the database runs in that process.

SQL runs beside the data instead of behind a server

DuckDB embeds an analytical database in the process that calls it. The CLI opens it directly, and clients exist for Python, R, Java, Wasm, and other environments. A query can read a CSV or Parquet path in the FROM clause without a separate import job. That makes DuckDB well suited to notebooks, local data preparation, application analytics, and tests where installing and operating a server would add more work than the query itself.

The SQL surface goes beyond simple filters and aggregates. DuckDB documents nested and correlated subqueries, window functions, collations, arrays, structs, maps, and convenience extensions to the dialect. Python can query pandas objects, while R integrates with dplyr. The process can keep data transient or write a portable database file. None of this requires a daemon, user account, or listening port for the basic local path.

Our 24-second install covered the C API specification

The repository at commit 044a04a contained 15,242 files, about 1,214,802 lines of source, and occupied 249.2 MB. Our harness detected a Python project under api_spec/, installed 36 packages in 24 seconds, and used 37 MB for that environment. Its build completed in 4 seconds. Pip-audit reported 0 known vulnerabilities in the installed Python dependency set.

That directory is a declarative specification for DuckDB's C API. YAML modules feed a pinned generator that produces duckdb.h, the extension header, and an engine-side function table. The project README requires Python 3.12 or newer and explains how generated files are checked for drift. Our result says this generator environment installed and built. It says nothing about SQL throughput, Parquet speed, extension behavior, or compilation of the C++ database.

What happened when we ran it

Our sandbox installed the api_spec/ project in 24 seconds and built it in 4 seconds. Pytest then ended with exit code 5 after 5 seconds and printed no tests ran in 0.01s. Its count was 0 passed and 0 failed out of 0. A zero-test run is a failed test step, not a successful suite with no defects.

The checkout did contain a tests directory and 27 CI workflow files, while our scan found no Dockerfile. DuckDB's root README directs engine contributors to make unit and make allunit, which are separate from the pytest command selected for the nested Python project. We did not run those C++ targets. Any claim that commit 044a04a passed or failed the full database suite would go beyond our measurement.

One process can write, while many may read

DuckDB's concurrency model is clear. One process can open a database in read-write mode and use multiple writer threads inside that process. Several processes can open the same file in read-only mode. The documentation says automatic multi-process writes are not a primary design goal, although an application can coordinate writes itself. This differs from a server database that accepts independent remote writers and owns their coordination.

Within a single process, appends do not conflict and optimistic concurrency control handles updates. Two threads changing the same rows can still produce a conflict that the application must retry. This model fits bulk ingestion and analytical transformation far better than a transactional web backend with many small edits. DuckDB can analyze that application's exports or replicas without becoming its system of record.

Direct file queries still depend on file and server behavior

Reading Parquet and CSV by path removes a staging step, which is often the appeal. Remote access through extensions adds another boundary. Open issue 25028 reports DuckDB 1.5.5 rejecting a public JSON API whose HTTP 206 response has inconsistent range headers. The reporter's workaround is to download the file before querying it. That case is specific, but it shows that SQL syntax cannot normalize every remote server's HTTP behavior.

Extensions also change what ships in the process. DuckDB uses them for formats, cloud access, and specialist functions such as spatial queries. Release v1.5.5 contains many extension bumps alongside engine fixes. Pin the DuckDB release and extension set, record where extensions come from, and exercise the exact file formats and endpoints used in production. A query engine embedded in your application shares its upgrades and failure domain.

An active release line still needs workload-specific tests

GitHub recorded 40,686 stars, 794 open issues and pull requests, and a last push on August 26, 2026. Release v1.5.5 arrived July 22 as a bug-fix release. Its notes include out-of-bounds fixes, a temporary-memory deadlock fix, storage and Parquet corrections, extension updates, and a concurrent ALTER and INSERT crash fix. The combined open count includes pull requests, so 794 is not a bug total.

A fresh open issue for v1.5.5 supplies a query that reportedly crashes when spatial functions, a correlated subquery, LEFT JOIN, GROUP BY ALL, and null rows meet. One narrow report does not outweigh the project's maturity, but it is a reminder to keep regression queries for the SQL shapes you depend on. DuckDB is easy to try and often the right embedded analytical engine. Production confidence still comes from testing your files, extensions, concurrency pattern, and queries.

Alternatives

ProjectWhat it isPick it when
SQLiteA small embedded SQL database aimed mainly at application storage and transactions.pick this instead when row-level application transactions and a tiny embedded footprint matter more than analytical scans.
ClickHouse gh↗A server database for large analytical workloads and concurrent remote clients.pick this instead when analytics must run as a shared network service across many users or machines.
Apache DataFusion gh↗A Rust query engine and library built around Apache Arrow data.pick this instead when a Rust-native query engine is the component you want to extend.

What people are saying

  1. [hackernews] AWS Acquires DuckDB
  2. [lobsters] A Preview of DuckDB v2.0
  3. [hackernews] A Preview of DuckDB v2.0
  4. [hackernews] Asynchronous I/O in DuckDB: Work, Thread, Work
  5. [hackernews] DuckDB – Data power tools for your laptop, now in Clojure (2023)

Sources

  1. DuckDB README
  2. DuckDB C API specification README
  3. DuckDB concurrency documentation
  4. DuckDB v1.5.5 release
  5. DuckDB httpfs range-response issue 25028
  6. DuckDB spatial crash issue 25039

More data reviews

GeoLibre · TradingView-API · os-taxonomy · Lean · bokeh · orm · the whole board →