{ "slug": "clickhouse", "name": "ClickHouse", "tagline": "Column-oriented OLAP database for real-time analytics over large datasets", "category": "database", "use_cases": [ "olap", "real-time-analytics", "time-series" ], "aliases": [], "status": "live", "upstream": { "vendor": "ClickHouse Inc.", "url": "https://clickhouse.com", "license": "Apache-2.0", "license_url": "https://github.com/ClickHouse/ClickHouse/blob/master/LICENSE" }, "image": { "os": "Ubuntu 24.04 LTS", "cis_level": 1, "ports": [ 8123, 9000 ], "artifacts": [ "/etc/lynxroute/sbom.json", "/etc/lynxroute/cis-report.html", "/usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md" ] }, "clouds": { "aws": { "status": "live", "version": "26.10.2.103", "last_build": "2026-10-29", "entity_id": "prod-akomedh3pqjqs", "ami_alias": "/aws/service/marketplace/prod-akomedh3pqjqs/latest", "listing_url": "https://aws.amazon.com/marketplace/pp/prodview-ovpjgqcbyjmva", "recommended_instance_type": "m6i.xlarge", "price_usd_per_hour": 0.05, "free_trial_days": 5, "unit": "instance-hour" }, "azure": { "status": "live", "version": "26.10.2.103", "last_build": "2026-10-29", "offer_id": "clickhouse", "plan_id": "payg-gen2", "image_urn": "lynxroute:clickhouse:payg-gen2:latest", "listing_url": "https://azuremarketplace.microsoft.com/en-us/marketplace/apps/lynxroute.clickhouse?tab=Overview", "recommended_vm_size": "Standard_D2s_v3", "price_usd_per_vcpu_hour": 0.028, "unit": "vcpu-hour" }, "alicloud": { "status": "not_offered" } }, "urls": { "page": "https://lynxroute.com/products/clickhouse/", "json": "https://lynxroute.com/products/clickhouse/product.json" }, "release_notes": [ { "version": "26.10.2.103", "title": "ClickHouse 26.10.2.103 r2", "notes": "* Fixes log rotation for the ClickHouse server logs. The previous image shipped a logrotate rule that listed the error log twice and lacked the su directive the log directory requires, so logrotate.service ended in a failed state on every boot and daily run and the ClickHouse logs were only capped by the server's own size limit\n* The application version is unchanged (ClickHouse 26.10.2.103); this is a maintenance rebuild. On a running instance the fix is one line: sudo sed -i -e '1s|.*|/var/log/clickhouse-server/*.log {|' -e '1a\\ su clickhouse clickhouse' /etc/logrotate.d/clickhouse-server && sudo systemctl reset-failed logrotate\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base, picking up every operating-system security update published since the previous build\n", "source": "backfill-aws-listing", "live": { "aws": "2026-10-29", "azure": "2026-10-29" } }, { "version": "26.10.2.103", "title": "ClickHouse 26.10.2.103", "notes": "* ClickHouse updated 26.9.8.3 -> 26.10.2.103, the 26.10 stable line. Apache-2.0 unchanged\n* Upgrade notes: system.metric_log moves to a compact bucketed schema (old queries keep working through alias columns), arrayCount returns UInt64, and the server now applies a seccomp system-call filter at startup - switch it to log or disabled if you rely on executable user-defined functions\n* Security: settings constraints are enforced for SQL-defined users and roles, overriding a stored named-collection key needs SHOW NAMED COLLECTIONS SECRETS, ATTACH TABLE FROM a path needs FILE grants, and MySQL connections with a CA now verify the server certificate and host name\n* Removes the legacy pre-analyzer query path and several long-obsolete settings\n* Rebuilt on the current CIS Level 1 hardened Ubuntu 24.04 LTS base for the latest Ubuntu security updates\n", "source": "backfill-aws-listing", "live": { "aws": "2026-10-29", "azure": "2026-10-29" } }, { "version": "26.9.8.3", "title": "ClickHouse 26.9.8.3", "notes": "* ClickHouse updated 26.8.8.8 -> 26.9.8.3, moving from the 26.8 long-term-support line to the 26.9 stable line. Apache-2.0 unchanged\n* Upgrade notes: default compression changes from LZ4 to ZSTD(3) for network traffic and for MergeTree parts of 100 MB and above, the analyzer can no longer be disabled, and CatBoost and WINDOW VIEW are removed - revoke any SYSTEM RELOAD MODEL grants before upgrading an existing server\n* Security: backup and restore to a disk now require the matching READ or WRITE ON DISK grant, renaming files after reading a File source requires WRITE ON FILE, and remote() passwords are no longer written to the query and text logs\n* New: DISTINCT can spill to disk, refreshable materialized views can refresh incrementally, CREATE TOKEN issues scoped expiring credentials, and tables and databases accept size and table-count limits\n* Fixes a server crash on gRPC queries with transport compression and wrong results for GROUP BY or DISTINCT keys derived from partition columns\n* Rebuilt on the current CIS Level 1 hardened Ubuntu 24.04 LTS base for the latest Ubuntu security updates\n", "source": "backfill-aws-listing", "live": { "aws": "2026-10-02", "azure": "2026-10-02" } }, { "version": "26.8.8.8", "title": "ClickHouse 26.8.8.8", "notes": "* ClickHouse 26.8.8.8 on Ubuntu 24.04 LTS - patch update from 26.8.6.5 on the 26.8 long-term-support line, covering 26.8.7.19 and 26.8.8.8. Apache-2.0 unchanged\n* Security: closes access-check gaps where PARALLEL WITH, EXECUTE AS and the QueryRunner table engine let CREATE statements bypass privileges and the readonly and allow_ddl settings, and where an HDFS database served cached tables without the READ ON HDFS grant or past the remote_url_allow_hosts filter\n* Security: the URL database engine no longer prints its password in SHOW CREATE DATABASE, system.databases or the query log, text-index reads are denied whenever a row policy applies to the table, and a path containing a NUL byte can no longer point a local Delta Lake or Iceberg table outside user_files\n* Fixes a server exit when a transient error occurs while loading outdated parts in the background, a Keeper exit on a multi request with no subrequests, wrong values or read failures for columns whose stream names differ only by escaping, and hasToken queries on a text index returning no rows when a lightweight update is pending\n* Adds validate_group_by_all_key_types, which can be turned off to accept Variant or Dynamic grouping keys in GROUP BY ALL as before 26.7, and optional record-batch batching for the Arrow output formats\n* Performance: LEFT and FULL JOIN with join_use_nulls use less memory, and a small LIMIT on an arrayJoin query reads smaller blocks again\n* Time-zone data updated to 2026c\n* Rebuilt on the current CIS Level 1 hardened Ubuntu 24.04 LTS base for the latest Ubuntu security updates\n", "source": "backfill-aws-listing", "live": { "aws": "2026-09-20", "azure": "2026-09-21" } }, { "version": "26.8.6.5", "title": "ClickHouse 26.8.6.5", "notes": "* ClickHouse 26.8.6.5 on Ubuntu 24.04 LTS - patch update from 26.8.5.13 on the 26.8 long-term-support line. Apache-2.0 unchanged\n* Fixes a logical error for RIGHT JOIN with parallel replicas, and a \"Next task callback is not set\" error when plan-based parallel replicas read a system log table\n* Faster query analysis for large parameterized views\n* Rebuilt on the current CIS Level 1 hardened Ubuntu 24.04 LTS base for the latest Ubuntu security updates\n", "source": "backfill-aws-listing", "live": { "aws": "2026-09-17", "azure": "2026-09-17" } }, { "version": "26.8.5.13", "title": "ClickHouse 26.8.5.13", "notes": "* ClickHouse 26.8.5.13 on Ubuntu 24.04 LTS - patch update from 26.8.2.7 on the 26.8 long-term-support line. Apache-2.0 unchanged\n* Security: PostgreSQL wire-protocol prepared-statement parameters are bound as data, RESTORE rejects backup entries whose paths leave the part directory, and bundled OpenSSL moves to 3.5.8, libxml2 to 2.15.4 and libssh to 0.12.2\n* Access control tightened: CREATE ... OR REPLACE also requires the DROP privilege, TRUNCATE ... ON CLUSTER requires DROP DATABASE, and the executable table function honours the Executable table-engine grant\n* Fixes TTL expressions with large intervals on Date and DateTime columns, and incremental backups to Azure Blob Storage\n* Rebuilt on the current CIS Level 1 hardened Ubuntu 24.04 LTS base for the latest Ubuntu security updates\n", "source": "backfill-aws-listing", "live": { "aws": "2026-09-16" } }, { "version": "26.8.2.7", "title": "ClickHouse 26.8.2.7", "notes": "* ClickHouse 26.8.2.7 on Ubuntu 24.04 LTS - update from 26.7.5.10 onto the 26.8 long-term-support line. Apache-2.0 unchanged\n* Fixes a settings-constraint bypass: a SETTINGS clause inside a subquery, a CTE or a view's inner query is now clamped to the configured constraints instead of being applied unchecked\n* Fixes a bloom_filter skip index returning too few rows for an IN over an Array column when the set contains an empty array\n* Fixes a 404 when reading an Iceberg table through a path above the table directory with an explicitly named metadata file\n* GROUP BY without aggregates, and formatDateTime with a non-constant timezone, both run faster\n* Adaptive GROUP BY aggregation now honours max_rows_to_group_by in the default throw overflow mode, including across parallel two-level aggregation\n* Moving onto 26.8: the server now refuses to start when its configuration contains an unknown top-level element, rather than ignoring it silently\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base\n", "source": "backfill-aws-listing", "live": { "aws": "2026-09-06", "azure": "2026-09-09" } }, { "version": "26.7.5.10", "title": "ClickHouse 26.7.5.10", "notes": "* ClickHouse 26.7.5.10 on Ubuntu 24.04 LTS - patch update from 26.7.3.19 on the 26.7 line. Apache-2.0 unchanged\n* Fixes a Nullable(Tuple(...)) column being flattened across several CSV fields, which gave a row-dependent column count and broke CSVWithNames / CSVWithNamesAndTypes round-trips\n* Fixes uniq, uniqExact, uniqHLL12 and uniqTheta returning a wrong result for an argument wrapped in an injective function that hides nullability\n* Fixes SELECT count(arrayJoin(arr)) returning the stored row count instead of the number of array elements, and 0 over file() and url()\n* Fixes has, indexOf, countEqual, mapContainsKey, mapContainsValue and Map subscript returning \"not found\" for a constant LowCardinality needle equal to the element type's default\n* Fixes a settings profile carrying a Map-valued setting (http_response_headers, additional_table_filters) being stored unreadably and left permanently unloadable after a restart\n* Rejects a corrupted or malicious dictionary before the buffer write, and fixes setting propagation and NULL handling in accurateCastOrDefault\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base\n", "source": "backfill-aws-listing", "live": { "aws": "2026-08-23" } }, { "version": "26.7.3.19", "title": "ClickHouse 26.7.3.19", "notes": "* ClickHouse 26.7.3.19 on Ubuntu 24.04 LTS - patch update from 26.7.1.1315 on the 26.7 line. Apache-2.0 unchanged\n* Backward-incompatible: S3 access originating from user SQL no longer falls back to the server's own cloud credentials - pass explicit credentials or NOSIGN\n* Backward-incompatible: use_legacy_to_time now defaults to 0, so toTime() returns the Time data type; the deprecated snowflakeToDateTime and snowflakeToDateTime64 functions were removed\n* Backward-incompatible: DateTime64 range widened to 0000-01-01 .. 9999-12-31, and the '**/' glob now also matches the directory itself\n* Backward-incompatible: AggregatingMergeTree now rejects, at CREATE time, columns that are neither in the sorting key nor aggregate states\n* New: EXPLAIN ANALYZE with real execution metrics, Remote and RemoteSecure table engines, GeoJSON input/output, projections with a WHERE clause\n* Faster: JOINs prune granules via the primary key, hash joins use less memory, ZSTD decompression is faster on ARM64\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base\n", "source": "backfill-git", "live": { "aws": "2026-08-18", "azure": "2026-08-19" } }, { "version": "26.7.1.1315", "title": "ClickHouse 26.7.1.1315", "notes": "* ClickHouse 26.7.1.1315 on Ubuntu 24.04 LTS - version update from 26.6.2.81. Apache-2.0 unchanged\n* Backward-incompatible: S3 access originating from user SQL no longer falls back to the server's own cloud credentials - pass explicit credentials or NOSIGN\n* Backward-incompatible: use_legacy_to_time now defaults to 0, so toTime() returns the Time data type; the deprecated snowflakeToDateTime and snowflakeToDateTime64 functions were removed\n* Backward-incompatible: DateTime64 range widened to 0000-01-01 .. 9999-12-31, and the '**/' glob now also matches the directory itself\n* Backward-incompatible: AggregatingMergeTree now rejects, at CREATE time, columns that are neither in the sorting key nor aggregate states\n* New: EXPLAIN ANALYZE with real execution metrics, Remote and RemoteSecure table engines, GeoJSON input/output, projections with a WHERE clause\n* Faster: JOINs prune granules via the primary key, hash joins use less memory, ZSTD decompression is faster on ARM64\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base\n", "source": "backfill-git", "live": { "aws": "2026-07-23", "azure": "2026-07-27" } }, { "version": "26.6.2.81", "title": "ClickHouse 26.6.2.81 - July 2026", "notes": "* ClickHouse 26.6.2.81 on Ubuntu 24.04 LTS - version update from 26.3.12.3.\n Apache-2.0 unchanged\n* CPU baseline raised: the default x86 build now targets x86-64-v3 (AVX2), so\n the instance must be Haswell or newer (Excavator or newer on AMD). All\n recommended instance types (t3.large, m6i.large, m6i.xlarge, m6i.2xlarge)\n satisfy this; on an older instance family the amd64compat build is required\n* Changed defaults: date_time_input_format and cast_string_to_date_time_mode\n now default to best_effort (previously basic) - date/time strings that used\n to be rejected are now parsed\n* Changed default: insert_deduplication_version now defaults to\n new_unified_hash (previously compatible_double_hashes) - identical parts are\n no longer cross-deduplicated and reordered inserts are no longer deduplicated\n* Tightened HTTP limits: http_max_fields 1,000,000 -> 1,000 and\n http_max_field_name_size 128 KB -> 4 KB\n* Deprecated: system.histogram_metric_log, superseded by a histograms column on\n system.metric_log\n* No data migration required\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base\n* CVE-scanned before every release\n", "source": "backfill-aws-listing", "live": { "aws": "2026-07-21", "azure": "2026-07-22" } }, { "version": "26.3.12.3", "title": "ClickHouse 26.3.12.3 - May 2026", "notes": "* ClickHouse 26.3.12.3 (LTS) on Ubuntu 24.04 LTS\n* Track switch from stable (26.1.x) to LTS (26.3.x) - long-term support release\n for buyers who prefer predictable maintenance windows and backported security\n fixes over the rapid stable cadence\n* Hardened firstboot: HTTP readiness probe replaces fixed sleep, password\n generation is idempotent across reboots, credentials.txt and users.d/ can\n no longer diverge\n", "source": "backfill-aws-listing", "live": { "aws": "2026-05-24", "azure": "2026-06-07" } }, { "version": "26.1.12.23", "title": "ClickHouse 26.1.12.23 - Initial release (May 2026)", "notes": "* ClickHouse 26.1.12.23 on Ubuntu 24.04 LTS\n* CIS Level 1 hardening applied (ansible-lockdown/UBUNTU24-CIS)\n* CVE-scanned before every release\n* Strong random password for the ClickHouse default user generated at first boot, stored as SHA-256 hex\n* listen_host = 0.0.0.0 on HTTP (8123) and native TCP (9000); IPv6 disabled at the kernel\n* UFW firewall pre-configured (ports 8123, 9000 only)\n* fail2ban, auditd, AppArmor pre-configured\n* SBOM (CycloneDX 1.6) at /etc/lynxroute/sbom.json\n* CIS Conformance Report (OpenSCAP) at /etc/lynxroute/cis-report.html\n* IMDSv2 enforced\n", "source": "backfill-aws-listing", "live": { "aws": "2026-05-14" } } ], "release_history": [ { "version": "26.10.2.103", "aws": "2026-10-29", "azure": "2026-10-29" }, { "version": "26.9.8.3", "aws": "2026-10-02", "azure": "2026-10-02" }, { "version": "26.8.8.8", "aws": "2026-09-20", "azure": "2026-09-21" }, { "version": "26.8.6.5", "aws": "2026-09-17", "azure": "2026-09-17" }, { "version": "26.8.5.13", "aws": "2026-09-16" }, { "version": "26.8.2.7", "aws": "2026-09-06", "azure": "2026-09-09" }, { "version": "26.7.5.10", "aws": "2026-08-23" }, { "version": "26.7.3.19", "aws": "2026-08-18", "azure": "2026-08-19" }, { "version": "26.7.1.1315", "aws": "2026-07-23", "azure": "2026-07-27" }, { "version": "26.6.2.81", "aws": "2026-07-21", "azure": "2026-07-22" }, { "version": "26.3.12.3", "aws": "2026-05-24", "azure": "2026-06-07" }, { "version": "26.1.12.23", "aws": "2026-05-14" } ], "deploy": { "aws_cli": "# subscribe once on the AWS Marketplace listing, then:\naws ec2 run-instances \\\n --image-id resolve:ssm:/aws/service/marketplace/prod-akomedh3pqjqs/latest \\\n --instance-type m6i.xlarge --key-name my-key --security-group-ids sg-xxxxxxxx", "azure_cli": "# accept the plan terms once, then:\naz vm image terms accept --publisher lynxroute --offer clickhouse --plan payg-gen2\naz vm create -g my-rg -n clickhouse --size Standard_D2s_v3 \\\n --image lynxroute:clickhouse:payg-gen2:latest --admin-username azureuser --generate-ssh-keys" }, "description": { "what_is": "ClickHouse is an open-source column-oriented online analytical processing (OLAP) database management system written in C++ and distributed as a single compiled native binary. It is designed for low-latency analytical queries over very large tables: aggregations, time-series rollups, ad-hoc SQL on billions of rows. Features include the MergeTree storage engine with automatic part merges and partitioning, distributed and replicated tables for horizontal scale-out, materialized views, dictionaries, projections, an HTTP REST API on port 8123, a fast native binary protocol on port 9000, and a built-in web SQL console at /play. SQL is extended with array, tuple, nested, JSON, and IPv4/IPv6 types. Standard ODBC and JDBC drivers and client libraries for most popular languages are available. Data is persisted on local disk under /var/lib/clickhouse - no external database required for single-node deployments. Apache-2.0 license, no vendor lock-in. A self-hosted alternative to proprietary cloud data warehouses for hot-data analytics, keeping all data inside your own AWS account.", "image_adds": "Security hardening:\n* Strong random 32-character password generated per instance at first boot for the ClickHouse default user\n* Password stored only as SHA-256 hex in users.d drop-in - never written in plain text inside the image\n* UFW firewall pre-configured - ports 8123 and 9000 open externally for buyer use, port 22 for SSH; all other inbound traffic dropped\n* fail2ban, AppArmor enabled\n* CVE scan - every image is scanned for vulnerabilities before release\n\nOS hardening (CIS Level 1):\n* CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown\n* auditd, SSH hardening (key-only, PermitRootLogin no, LoginGraceTime 60), Kernel hardening (ASLR, reverse path filtering, SYN cookies, kexec disabled, IPv6 off), IMDSv2 enforced\n\nCompliance artifacts:\n* SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json\n* CIS Conformance Report at /etc/lynxroute/cis-report.html\n* CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md" }, "generated_at": "2026-10-31T09:36:34Z" }