Skip to content

Operations

This page covers how the image is secured, where your data lives, how to back it up and update it, and how to get help.

Security model

  • DuckDB does not listen on any port. You only need SSH (22/tcp), and only if you do not use Session Manager.
  • No password, private key or access key is created or baked into the image.
  • The S3 folder /etc/duckdb/secrets is root:duckdb, mode 0750. The ubuntu user is not in the duckdb group and cannot read it.
  • duckdb-sql is a convenience wrapper, not a sandbox. A query can read and write any file its Linux user can, and can reach HTTP and S3 endpoints. Run only SQL you have reviewed, as an unprivileged user.
  • Any process on the instance that can reach the instance metadata service can use the instance role. Give the role only the access you need, and only allow trusted users on the instance.

See DuckDB's security overview for more.

Where your data lives

Path Contents
Your own folders, for example /home/ubuntu CSV and Parquet files you query
/var/lib/duckdb/ Workspace for the duckdb user. Not a durable warehouse.
/etc/duckdb/ Settings and your S3 SQL file
/tmp/sushi-duckdb-<uid>/spill Temporary spill files

DuckDB starts in memory for each duckdb-sql run. Data persists only in the files you write.

Backups

  • Take EBS snapshots of the root volume if local files must survive the instance.
  • Data you keep in your own S3 prefix survives instance replacement. The image does not set up bucket versioning, retention or a second copy for you.
  • Back up /etc/duckdb/duckdb.env and your SQL files under /etc/duckdb/secrets/ if you changed them.

Updates

  • Ubuntu unattended security updates are enabled.
  • DuckDB and its extensions are pinned to v1.5.6. They are not APT packages and are not updated by apt.
  • A new AMI version does not update running instances. To move to a new version, launch the new AMI, copy your files and settings, and attach the same IAM role. Test your queries against a copy of your data first.

Check the installation

Print the DuckDB version:

/usr/local/bin/duckdb -version

Run the image self-test:

sudo /opt/sushi/bin/smoke.sh

It queries CSV and Parquet, checks the pinned extensions and confirms that ubuntu cannot read the secrets folder. It does not call AWS. It ends with duckdb CSV, Parquet, localhost httpfs, and localhost S3 denial checks passed.

Service management

There is no long-running DuckDB service. The only unit is the one-time first-boot service:

systemctl status sushi-duckdb-firstboot.service
sudo journalctl -u sushi-duckdb-firstboot.service --no-pager

Licenses

DuckDB and the httpfs and aws extensions are MIT-licensed. License files, the matching source archives and a source notice are in /usr/share/doc/duckdb/.

Support

Software Sushi provides AMI packaging and setup guidance. Email info@softwaresushi.com with the product version and the steps to reproduce your issue. Do not send credentials. Support coverage requires a separate agreement, and DuckDB project support is not included.