Shaper: SQL-first dashboards and embedded analytics

The query is the dashboard

Shaper is an open source, SQL-first set of data dashboards, reports and customer-facing analytics, and the description in the repository is three words long: visualize and share your data, all in SQL, powered by DuckDB.

The example in the README shows what that means in practice, and the SQL is not quite SQL.

SELECT 'Sessions per Week'::LABEL;
SELECT
  date_trunc('week', created_at)::XAXIS,
  category::CATEGORY,
  count()::BARCHART_STACKED,
FROM dataset
GROUP BY ALL ORDER BY ALL;

The structure is ordinary: one statement labels the dashboard, and the second selects the data. What is different is that the columns carry casts that say what role they play. The date column is cast to XAXIS, which makes it the axis. The category column is cast to CATEGORY, which makes it a series. The count is cast to BARCHART_STACKED, which is the chart itself. GROUP BY ALL and ORDER BY ALL replace the boilerplate.

So a dashboard is a query with annotations, and the visualisation is a projection of the query's result. That is a compact and legible model, and it is why the project describes itself as AI-ready, since the unit of work is text rather than a configuration tree.

The quickstart is a single container

The quickest way to try Shaper without installing anything is to run it with Docker.

docker run --rm -it -p5454:5454 taleshape/shaper

The port flag in the README is written without a space, so the published command is a trap for anyone who copies it into a shell that splits on whitespace, and the working form is with the space. Either way the container listens on 5454, and then you open http://localhost:5454/new in a browser to start with a new dashboard.

Beyond that there are two guides, a Getting Started Guide and a Deployment Guide for running it in production, and a documentation site with the full reference.

The release history is fast. v0.24.13 on 2026-10-07, v0.25.0 on 2026-10-08 and v0.25.1 on 2026-10-09, with the last push to the repository on 2026-10-13, so this is a project in active development with small releases every few days.

The licence is the Mozilla Public License 2.0, with the copyright held by Taleshape OÜ for 2024 to 2026.

Three surfaces, and the features under each

The features section is organised into three groups, and the grouping is the product structure.

Data visualisation covers the basics of running it yourself: open source and self-hosted, SQL-first and AI-ready, a Git-based workflow so that a dashboard is a file in a repository, and querying across data sources.

Embedded analytics is the part aimed at other people's customers: white-labeling with custom styles, row-level security through JWT tokens, and embedding without an iframe through JavaScript and React SDKs.

Automated reporting generates PDF, PNG, CSV and Excel, schedules alerts and reports, and produces shareable password-protected links.

The Git-based workflow is worth a second look, because it is the piece that makes this different from a hosted dashboard product. If a dashboard is a SQL file in a repository, it can be reviewed, it can be branched, and it can be deployed by the same pipeline as the code, and the README lists it as a first-class feature rather than an afterthought.

The password-protected link for reports and the row-level security through JWT tokens are the two features that make the embedded product defensible, since a customer-facing dashboard with no way to scope who sees what is not much of a product.

The Go backend carries more infrastructure than you would expect

The go.mod lists the shape of the server, and it is a longer list than a dashboard tool usually needs.

The core is DuckDB through duckdb-go, with the per-platform binding packages for Linux, macOS and Windows, and an Echo v4 HTTP server with JWT support through echo-jwt and the standalone golang-jwt library. sqlx handles the SQL side, and there is a websocket library and a NATS server with its Go client, which points to an internal event bus rather than a request-response server alone.

Then the features that explain the rest. minio-go is the S3 compatible object storage client, and excelize is the library that produces the Excel exports. chromedp drives a headless browser, which is how a PDF or PNG rendering of a dashboard gets produced, and it explains the headless-shell dependencies in the container image. Prometheus client for metrics, gopsutil for system information, and notify for desktop notifications.

There is a SQLite driver too, through modernc.org/sqlite, alongside DuckDB, which is the sort of pairing you see in a product where DuckDB analyses the data and something else holds the application state.

The module targets Go 1.26.9, and the repository is organised as a main.go at the root with server/ and ui/ directories, plus npm-package/ and pip-package/ directories for the two embedding SDKs.

The container image explains its own choices

The Dockerfile is worth reading, because the comments in it are unusually candid about the trade-offs.

The base is debian:13.7-slim pinned by digest, and the comment gives two reasons. DuckDB is dynamically linked because some extensions have issues with static linking, and a shell is useful for debugging. Debian is used instead of Alpine because Debian uses glibc and DuckDB has issues with musl.

The installed package list is annotated in the same way. gosu is there for stepping down from root, and socat is installed. The comment about wget is the interesting one: it was previously used for healthchecks, which are now handled by a shaper healthcheck command, and it is kept anyway to avoid breaking downstream images or user workflows that rely on it.

Two entries have crash notes attached. libsqlite3-0 is required by headless-shell, because libnss3 links against it for the certificate and key databases, and removing it causes headless-shell to crash fatally on launch with a specific error code. And perl-base and gzip are Debian essentials that scanners may flag for unfixable issues, which the comment says is not a practical attack surface because they are not invoked by shaper or headless-shell, and which are kept so that downstream images can run apt-get install without breaking debconf and dpkg.

That is a well maintained image, and the reasoning in it is the kind of thing that saves a day when a base image changes.

Open source, managed hosting, and who owns the compliance work

The project is 100% free and open source, and through Taleshape the same company offers managed hosting and hands-on support, which is offered in our cloud or in your infrastructure. The README is unusually clear about the boundary, and it puts it in a table.

On the self-hosted side, you own the infrastructure and uptime, you track releases and apply security patches, you configure firewalls and TLS, you are responsible for your own audits and certifications such as SOC 2, ISO 27001, HIPAA and GDPR, and you manage users, API keys and dashboard permissions. You also author and maintain the queries and reports yourself.

On the managed side, Taleshape provisions and monitors the infrastructure, applies zero-downtime updates and security patches, enforces secure defaults and encryption, provides audit support and compliance documentation, and runs health checks, backup management and failover support. Access control and dashboard authoring stay with you in both columns, which is the point worth holding on to, because it means the managed offering does not take your queries away from you.

The data location row is the one to read twice. In both columns the data is stored entirely within your own infrastructure, and the managed column adds that they do not store your analytical data. A managed service that runs the software next to your warehouse rather than next to their own is a different product from the usual managed dashboard, and it is the reason the compliance story is a shared responsibility table rather than a marketing sentence.

The repository also carries a SECURITY.md, an osv-scanner configuration and a Go linter configuration, and the contributing guide and release notes are in the usual places.

Editorial conclusion

Shaper fits a team that wants a dashboard defined by a query rather than by clicking a chart together, that needs to hand the same dashboard to customers under their own branding, and that would rather run the whole thing on its own infrastructure. It does not fit a team that needs a heavyweight BI product with a visual query builder, and it does not fit a team unwilling to write SQL. Verify three things before you commit: that the SQL dialect extensions you need exist, since the chart types are expressed as casts rather than as separate statements, that you are comfortable with the DuckDB model, where the data lives and how the sources are attached, and that you have read the shared responsibility table, because the difference between self-hosting and the managed offering is entirely about who owns the compliance work.

Frequently asked questions

Official sources

1. License: MPL-2.0
2. Project website
3. README
4. Releases
5. taleshape-com/shaper on GitHub