Back to catalog
Supabase OSS
Apache-2.0Self-host Supabase OSS for a private Postgres backend with auth, storage, and realtime APIs under Apache-2.0, eliminating cloud vendor lock-in.
Open-source alternative to — compare it against:
Overview
Supabase packages PostgreSQL alongside PostgREST, GoTrue, Realtime, and Kong into a containerized backend stack that runs directly on private infrastructure. Deploying this distribution via Docker gives engineering teams total sovereignty over schemas, row-level security rules, and user records without routing requests through a third-party cloud.
Why Supabase OSS instead of Supabase Cloud
Supabase Cloud provides managed PostgreSQL hosting with automated provisioning and scaling, but it stores database connections, credentials, and uploaded assets on vendor-managed systems. For organizations bound by data sovereignty frameworks or strict compliance mandates like HIPAA and GDPR, delegating database access to an external SaaS introduces regulatory exposure. Supabase OSS runs the entire backend runtime inside private networks, isolated virtual clouds, or on-premise servers. DevOps engineers retain direct superuser control over the PostgreSQL engine, enabling custom extensions, connection pool tuning with Supavisor, and strict firewall perimeters around sensitive data.
The trade-off centers on operational responsibility. Supabase Cloud handles automated backups, point-in-time recovery, and zero-downtime maintenance behind a multi-project console. Self-hosting Supabase OSS requires DevOps engineers to configure database replication, monitor storage volumes, manage secrets, and execute PostgreSQL upgrades manually. Additionally, the open-source Studio dashboard is designed for a single project instance rather than the multi-tenant organization hierarchy of the cloud edition. Migrating between the two distributions remains straightforward due to identical APIs and client libraries, allowing teams to prototype on the managed service and transition to self-hosted instances when data isolation policies require complete infrastructure control.
What it does well
- Native PostgreSQL foundation granting full superuser access, raw SQL execution, and compatibility with extensions like pgvector for AI workloads.
- Auto-generated REST and GraphQL APIs through PostgREST and pg_graphql that expose database tables without manual endpoint development.
- Granular data access control via native PostgreSQL row-level security policies enforced directly at the database layer.
- WebSocket streaming via the Realtime engine, broadcasting database changes directly to connected client applications.
