The curious case of Google's AlloyDB

2026-08-15T17:30:00+00:00
Google launched AlloyDB in 2022. They claimed it is fully compatible with PostgreSQL. Can be up to 100 times faster for analytical queries than vanilla Postgres. Four years later, I haven't personally seen it gain significant traction. But it comes in discussions. When people ask me what AlloyDB actually is, I was able to pin point the features, but wasn't really sure what it delivers.
Over the past 12 months, I’ve evaluated AlloyDB. This article shares my key findings. I tried to keep it as objective as the topic allows, and where it isn't, the text says so. I won't pretend to be objective about the verdict. It depends less on one feature and more on where compatibility ends. And as it goes, "it depends" a lot on your workload and needs.
Let's start with the first claim. What does "fully compatible" mean? In this case it covers the wire protocol. Your psql</code> connects, ORMs work, migration means changing connection string and you are done. What it does not cover is nearly everything you know about the Postgres storage internals and query executor. The 8KB pages that define storage layout for vanilla engine, are no longer the durable representation of your data. The WAL is no longer a recovery mechanism. It becomes the database. VACUUM is there, but runs inside storage layer you don't know and and schedule you can't control. And the tuning options differ from what you are be used to.
This creates the curious case. The compatibility claim is true, and the engineering behind AlloyDB backs it up. It's just narrower than the word "fully" migth suggest. AlloyDB is a different database behind the PostgreSQL protocol.
AlloyDB’s compatibility claim holds at the wire protocol, but the underlying engine diverges immediately at the storage layer.
Gartner defines HTAP, or hybrid transaction/analytical processing, as a new application architecture. It "breaks the wall" between transaction processing and analytics. This allows for better decision-making and real-time insights in business.</div>

The short version</strong> for the impatient. AlloyDB is not the database you reach for to host a side project or run a small app cheaply. It’s an enterprise HTAP engine for teams using GCP or looking to expand there. It handles both transactional and analytical workloads on one dataset. Usually, there's little to no ETL needed, which means less data copying between an OLTP store and a warehouse. It discusses PostgreSQL's wire protocol. The engineering behind it is solid. However, every feature comes at a cost-both in money and in how much existing PostgreSQL knowledge you can use. The economics aren't static, though. It changes increasingly in favor AlloyDB as the data grows and peak demand increases.</div>
What I'd verify before betting a migration on it:</p>

Whether your extensions survive the move. The allowlist differs between managed AlloyDB and Omni in ways you won't guess (plv8</code> and postgis</code> trade places); timescaledb</code> and pgrx are on neither.</li>
Whether the columnar store is actually resident before you trust a benchmark number, yours or mine. It can be enabled and silently empty.</li>
The read pool's economics for your</em> read shape. Bursty business-hours reads and flat around-the-clock reads land on opposite sides of the break-even.</li>
Write contention at your scale. My own run inverted between SF10 and SF100, and not in the direction the pitch suggests.</li>
ScaNN recall at your vector count.</li>
</ul>
The log is the database</a>
</h2>
In standard PostgreSQL the query engine and the storage engine run as a single process, and that process owns its storage. It writes 8KB pages to disk and writes WAL records so that the system can reconstruct those pages after a crash. The pages hold the data, the log is there to repair them, and under normal operation the compute node pays for both.</p>
AlloyDB inverts this. The compute node never writes full database pages to durable storage. Instead, it sends Write-Ahead Log (WAL) records to a distributed storage layer built on top of Colossus, Google's cluster file system. In this storage layer, a dedicated Log Processing Service (LPS) processes log records. It updates database pages asynchronously. When processing queries, the compute node fetches these pages as needed into its memory buffer pool. It also utilizes an ultra-fast local SSD block cache to cut reads from durable storage and accelerate page retrieval. Ultimately, the durable representation of your data is the log itself, and the data pages are derived from it without interruption.</p>
This format is proprietary and not open for independent inspection. In contrast, PostgreSQL's on-disk format is something I typically examine byte by byte here on the blog. The account that follows therefore describes the architecture as Google documents it.</p>
If you understand how PostgreSQL recovery works, take a moment to reflect on it. AlloyDB runs, permanently, in the mode a PostgreSQL hot standby lives in, a log replayed into pages. Except here it is the primary's write path, there is no other copy of the pages anywhere, and the replay happens on dedicated infrastructure.</div>
Five consequences follow; Google's marketing covers four of them.</p>
Failover stops being a replay problem</strong>. In standard PostgreSQL, a promoted standby needs to finish replaying WAL before it can accept writes. The time this takes depends on how far behind it was. In AlloyDB there is no deviation to replay, because the storage is shared. A replacement compute node attaches to the same storage layer and picks up where the old one left off.</p>
Read replicas are no longer copies</strong>. AlloyDB's "read pool" nodes are extra compute nodes attached to the same distributed storage as the primary. They still consume a log stream, and still flush and replay it, but they don't depend on replaying it to access the data.</p>
Storage management shifts to Google too</strong>. As the storage layer grows on its own, issues like resizing windows and disk-full incidents disappear.</p>
The write path drops full-page writes</strong>. Standard PostgreSQL protects against torn pages. It writes the full 8KB page into the WAL the first time it’s accessed after each checkpoint. full_page_writes</code> is on by default for a good reason. It’s a well-known source of WAL volume. When a workload has small scattered updates, it can use more log space for full-page images than for the row changes themselves. AlloyDB never takes on this overhead. The storage layer replays log records into pages and protects against torn pages. So, the compute node doesn't checkpoint or send a full-page image. It only ships change records.</p>
Aurora PostgreSQL disaggregates storage too, and the two get lumped together. The resemblance is real but shallow. Aurora ships redo records to six replicated storage nodes that apply them on their own. AlloyDB, on the other hand, uses a log-structured format on Colossus. It separates log processing from block serving tasks. Neither is open source, so the comparison stops at the whitepapers.</div>
The fifth consequence is the one the marketing leaves out.  You can no longer look at your own storage.</strong> There is no pageinspect</code> equivalent for AlloyDB's durable format. You can check the buffer pool, which holds pages in the compute-node RAM. However, the format used is proprietary and unclear. If you've ever walked through MVCC headers byte by byte</a> to solve a bloat issue or check what an UPDATE did, you can’t do that now. For many users this is an acceptable trade: they lose page-level visibility they probably never exercised and gain a managed storage layer.</p>
Azure's HorizonDB has been in preview since late 2025. It uses a log-is-the-database method from another cloud. This storage inversion is now the standard style. It stays OLTP-only and mirrors into Fabric for analytics, though, so the columnar half of this post has no equivalent there.</div>
Vacuum, rescheduled</a>
</h2>
Google's marketing barely mentions the consequence I went looking for first. VACUUM is a common topic for Postgres user and frequently covered on this blog. We’ve discussed everything from the lie in its name</a> to what it does page by page</a>. My first question was: what happens to it when storage moves off the compute node?</p>
In standard PostgreSQL, VACUUM is the compute node's burden. Dead tuples build up in heap pages. Autovacuum workers scan the heap, remove them, and update the visibility map. They also compete with your queries for I/O during this process.</p>
A whole subculture revolves around this:</p>

autovacuum_vacuum_scale_factor</li>
Cost-delay tuning</li>
Monitoring pg_stat_user_tables.n_dead_tup</li>
The issue of a long-running transaction that held back the xmin horizon, causing a table to double in size.</li>
</ul>
Going in, I expected vacuum to be the thing the storage layer absorbed. If the log is the database and pages are materialized on Google's side, dead tuples should be Google's problem. The stats say otherwise. The compute node uses the standard PostgreSQL executor with a standard buffer pool. So, UPDATE</code> and DELETE</code> leave dead tuples in the heap pages that the node reads. The tuples need pruning. The visibility map and free space map must be maintained. Also, rows need to be frozen before wraparound. That work still runs on the compute node. The storage layer sees every log record. It maintains versions of the blocks created from the log. Some cleanup happens outside the compute node, but the compute-side job remains unchanged. What Google actually replaced is the scheduler.</p>
AlloyDB's adaptive autovacuum changes community autovacuum's fixed thresholds. It features a smart controller that boosts worker count when idle and reduces it when busy. This approach targets large table fragments instead of whole tables. It also slows down transaction-ID use if a wraparound horizon is near. Plus, it spots problems that block vacuum progress, like long-running transactions and orphaned prepared transactions. If a backend's XID age crosses a set limit, it logs a warning. That last part only diagnoses the problem. The benchmark below checks this: if the compute node still vacuums, then autovacuum_count</code> should increase. Also, n_dead_tup</code> should show a saw-tooth pattern.</p>
This is verifiable from the outside, and you should verify it. Run a workload with many updates, like pgbench's default mix. Aim for a few hundred TPS for one hour. Test standard PostgreSQL and AlloyDB. Then, we can compare the results.</p>
SELECT</span> relname, n_dead_tup, n_live_tup,</span></span>
       autovacuum_count, last_autovacuum</span></span>
FROM</span> pg_stat_user_tables</span></span>
WHERE</span> relname </span>=</span> 'pgbench_accounts'</span>;</span></span></code></pre>
On standard PostgreSQL you'll watch n_dead_tup</code> saw-tooth, climbing between autovacuum passes and dropping after each one. AlloyDB does the same. Churning a one-million-row table with full-table UPDATE</code>s on AlloyDB makes n_dead_tup</code> rise to one to three million, then it drops. Meanwhile, autovacuum_count</code> increases with each pass, seven total in seven minutes. The identical workload on Cloud SQL produces the same shape and seven passes. There is no flatline and no vacuum-free steady state. The compute node is running autovacuum, exactly as the stock engine does, and what AlloyDB changed is when it runs, not whether. (Both time series are in the repo.)</p>
Managed AlloyDB supports pg_squeeze</code> with the alloydb.enable_pg_squeeze</code> flag. This means that when bloat builds up, you can perform an online, low-lock rebuild. It works like pg_repack</code> in stock PostgreSQL, so no VACUUM FULL exclusive lock is needed.</p>
Operationally this is a genuine win with one string attached. The win is that a recurring production failure mode (an instance accumulating vacuum debt faster than its autovacuum can clear it) is off your pager. The standard PostgreSQL vacuum rules now work differently or not at all. Any monitoring based on dead-tuple counts and autovacuum timing is tracking a process that Google controls. Alert thresholds calibrated against community autovacuum's fixed scale factors will fire on a schedule that no longer means what they were tuned for.</p>
Transaction ID wraparound doesn’t vanish just because storage is disaggregated. The other job, VACUUM, still handles it. AlloyDB still has 32-bit xids on the compute node, and its answer is documented. Adaptive autovacuum checks XID use against vacuum progress. When wraparound risk increases, it limits transaction-ID use and boosts vacuuming resources. That is wraparound protection, not wraparound elimination. Freezing affects how the storage layer cleans up, but the opaque format makes it hard for you to find the answer.</div>
The in-memory columnar store</a>
</h2>
PostgreSQL stores rows. Every heap page packs complete tuples, all columns of a row adjacent on the page. For OLTP this is the right call, since fetching a row is one page read. For analytics it is the wrong one. Computing SUM(l_extendedprice * (1 - l_discount))</code> for 60 million lineitem</code> rows requires reading all 60 million full 16-column tuples. However, only two columns are needed for the calculation. The buffer numbers in your EXPLAIN output</a> tell that story every time.</p>
AlloyDB uses an in-memory columnar store. This is a special memory area next to the buffer pool. It keeps certain columns from specific tables in columnar format. Plus, it supports vectorized execution. It is not a separate analytical database; there is no ETL, no second cluster, no sync job to babysit. The planner sees it as another access path. It picks between heap scan and columnar scan based on cost, just like it decides between sequential scan and index.</p>
The columnar engine is not an extension. It is compiled into the AlloyDB binary; you cannot install it on a standard PostgreSQL installation, and you cannot remove it from AlloyDB.</p>
The engine is observable through g_columnar_</code>-namespaced relations. This is what the store held during the scale-factor-100 run, after the columns the query set touches were pinned (the full per-column dump is in the repo):</p>
-- What's resident in the columnar store, by table</span></span>
SELECT</span> relation_name, </span>count</span>(</span>*</span>) </span>AS</span> columns, pg_size_pretty(</span>sum</span>(size_in_bytes))</span></span>
FROM</span> g_columnar_columns</span></span>
GROUP BY</span> relation_name </span>ORDER BY</span> sum</span>(size_in_bytes) </span>DESC</span>;</span></span></code></pre> relation_name | columns | pg_size_pretty</span></span>
---------------+---------+----------------</span></span>
 lineitem      |      13 | 25 GB</span></span>
 orders        |       6 | 5289 MB</span></span>
 part          |       2 | 172 MB</span></span>
 customer      |       2 | 129 MB</span></span>
 supplier      |       2 | 8796 kB</span></span>
 nation        |       2 | 954 bytes</span></span>
 region        |       1 | 417 bytes</span></span></code></pre>
Population can happen automatically. A background process looks at query patterns to decide which columns need memory. It can also be done explicitly.</p>
SELECT</span> google_columnar_engine_add(</span></span>
  'lineitem'</span>,</span></span>
  'l_quantity,l_extendedprice,l_discount,l_shipdate,l_returnflag,l_linestatus'</span></span>
);</span></span></code></pre>
Automatic population has a failure mode worth knowing, because it fails quietly, and I found it the hard way. The recommendation function uses observed columnar query history to decide what to cache. On a newly enabled engine or immediately after a restart, that history is empty, so the function may recommend nothing. The store stays empty, every plan falls back to a heap scan, and the queries run at full row-store speed with no error and no warning. The columnar engine is on, and it is doing nothing. The tell shows an empty g_columnar_columns</code> and a Seq Scan</code>, instead of the expected Custom Scan (columnar scan)</code>. Explicit google_columnar_engine_add</code> sidesteps it. Either way, verify the columns are resident before you trust a number. I didn't on one of the early SF100 runs, and that run measured nothing.</p>
When the planner picks the columnar path, the plan says so, and the buffer numbers explain why it's faster. Here is TPC-H Q6, which is the revenue query. It performs a selective scan of the lineitem</code> table, accessing four columns. This is tested at a scale factor of 100, with about 600 million rows, on AlloyDB Omni. The tests were done with the columnar store both off and on. Same box, same query. Trimmed to the lines that matter, with cost=</code> estimates and the filter predicates elided. These are the p90 runs, while the table below reports medians. Full plans are in the repo.</p>
Columnar off, the row store:</p>
 Finalize Aggregate  (actual time=182546.439..182546.691 rows=1 loops=1)</span></span>
   Buffers: shared hit=2560 read=11549743</span></span>
   I/O Timings: shared read=814349.441</span></span>
   ->  Gather  (actual time=182546.333..182546.679 rows=5 loops=1)</span></span>
         Workers Planned: 4</span></span>
         Workers Launched: 4</span></span>
         ->  Partial Aggregate  (actual time=182545.107..182545.108 rows=1 loops=5)</span></span>
               ->  Parallel Seq Scan on lineitem  (actual time=0.690..181854.379 rows=2284274 loops=5)</span></span>
                     Rows Removed by Filter: 117723307</span></span>
                     Buffers: shared hit=2560 read=11549743</span></span>
                     I/O Timings: shared read=814349.441</span></span>
 Execution Time: 182546.776 ms</span></span></code></pre>
Columnar on:</p>
 Finalize Aggregate  (actual time=594.954..595.135 rows=1 loops=1)</span></span>
   ->  Gather  (actual time=594.058..595.125 rows=5 loops=1)</span></span>
         Workers Planned: 4</span></span>
         Workers Launched: 4</span></span>
         ->  Partial Aggregate  (actual time=592.583..592.585 rows=1 loops=5)</span></span>
               ->  Parallel Append  (actual time=0.187..592.573 rows=564 loops=5)</span></span>
                     ->  Parallel Custom Scan (columnar scan) on lineitem  (actual time=0.186..592.569 rows=564 loops=5)</span></span>
                           Rows Removed by Columnar Filter: 117723307</span></span>
                           Rows Aggregated by Columnar Scan: 500216</span></span>
                           Columnar cache search mode: native</span></span>
                     ->  Parallel Seq Scan on lineitem  (never executed)</span></span>
 Execution Time: 595.220 ms</span></span></code></pre>
182 seconds to 0.6 seconds, a 307x drop on this run and 311x at the table's median below, and the two lines that carry it are Buffers: shared read=11549743</code> and I/O Timings: shared read=814349</code>. The row store reads 11.5 million pages off disk, 814 seconds of I/O summed across four workers and the leader, to filter out about 51 of every 52 rows. The columnar scan reads no heap pages at all. Columnar cache search mode: native</code> means it answered entirely from the in-memory store, and the Parallel Seq Scan on lineitem (never executed)</code> branch underneath it is the proof: the planner kept a heap path available and never touched it. The mechanism is the elimination of I/O: a heap scan of a 16-column table reads whole pages containing complete rows, then discards the unneeded column values; the columnar scan never loads those bytes. At 600 million rows the row store no longer fits in the buffer pool, so that discarded work becomes disk work.</p>
One caveat on this pair, because it is not a single-variable experiment. To hold those columns, C1 had about 31 GB of columnar store on top of its 16 GB buffer pool, while the row-store run got the 16 GB and nothing else. So this measures the engine and roughly three times more memory over the hot data together. The two cannot be cleanly separated, because making the hot set fit is the mechanism: the heap here is about 100 GB, so no buffer pool on a 64 GB box closes that gap. The SF10 comparison further down has no such confound.</p>
Q6 is the best case, not the general one. Across the query set at scale factor 100, the same columnar store on the same box produced these results:</p>
query</th> shape</th> row store</th> columnar</th> speedup</th></tr></thead>

Q6</td> selective scan, few columns</td> 182,517 ms</td> 587 ms</td> 311x</td></tr>
Q5</td> six-table join</td> 242,559 ms</td> 24,688 ms</td> 9.8x</td></tr>
Q12</td> join plus date filter</td> 201,411 ms</td> 41,708 ms</td> 4.8x</td></tr>
Q1</td> full-table numeric aggregate</td> 186,377 ms</td> 94,195 ms</td> 2.0x</td></tr>
point lookup</td> single row by key</td> 0.15 ms</td> 0.11 ms</td> none</td></tr>
</tbody></table>
A selective scan that reads some columns and ignores most rows is very effective. A join is also quite beneficial. A full-table numeric aggregate is somewhat useful, as the math outweighs the I/O. The single-row lookup is the control. The planner takes the b-tree and the columnar store never enters the plan, exactly as it should. So "up to 100x" is a number for one query shape at one scale, not a general multiplier: Q6 clears it comfortably here, and nothing else in the set comes close.</p>
Two queries are missing from that table, and the reasons are worth stating. Q14's row-store run never happened. It died with could not resize shared memory segment</code>, which is my own provisioning and not a property of either engine, so there is no baseline to compare the columnar run against. Q18 did run on the row store, three times, at around 655 seconds each. But the columnar run was killed by a 300-second statement timeout, so the two sides never ran under the same limit and no speedup can honestly be derived from the pair. Both are withdrawn rather than reported. At SF10, where both finish cleanly, Q18 gains 1.14x, the smallest win in the set.</p>
When it helps, when it doesn't, when it hurts</a>
</h3>
The columnar store accelerates one shape of query.</p>
It helps</strong> for scan-heavy aggregations over large tables touching few columns. TPC-H Q1, Q6, and Q14 are the canonical shapes. The dashboard query that counts and sums everything. AlloyDB's main selling point is the HTAP case. It runs a reporting query on live operational data. This happens because no one built the warehouse.</p>
It doesn't help</strong> with point lookups, where the planner correctly takes the b-tree and the columnar store never enters the picture. Single-row OLTP. On small tables, the same aggregation on lineitem</code> subsets shows that columnar is slower than heap with 100K rows (31.6 ms vs 27.5 ms). Here, the store's overhead is more than the scan. Columnar pulls ahead at around 1M rows, gaining a 1.2x speedup. This advantage grows to 2x by 20M rows. The crossover is around a few hundred thousand rows. Below that, the heap stays in the buffer pool, so there’s nothing to gain. This is an in-memory result at SF10, so it measures the vectorization crossover; at scale, where the heap spills to disk, columnar pays off far sooner.</p>
It can hurt</strong> write-heavy tables with pinned columns. The columnar store must match the heap. So, when writes happen, they invalidate columnar blocks. Then, background work repopulates those blocks. Pin the columns of a table taking a thousand INSERTs a second and the maintenance can cost more than the scans save. Google's auto-population is supposed to notice and back off; whether it does for your write pattern is something to verify, not assume. Measured at the low end it is cheap. Pinning lineitem</code>'s columns added about 1% to a one-million-row bulk load (the number is in The numbers below), and that cost scales with write rate.</p>
The main question about the HTAP pitch is: can the columnar engine maintain OLTP throughput while an analytical scan runs on the same instance? I expected it to. Taking the scan's I/O off the table should free the machine for writes. It doesn't. At SF10 it is a wash.</p>
Write throughput drops by about 13.5% during concurrent scans, whether reading from the heap or store. This happens because the scanned table is in memory. The issue is with compute contention, not I/O, and columnar structures don't help with that. Fair enough at that size, nothing to win.</p>
At SF100, where the heap spills to disk, turning columnar on makes the contention worse (29% versus 16%). The mechanism and the full numbers are in The numbers below. For deployment, what it means is that the isolation has to come from a dedicated read pool node with its own CPUs, and it is paid for in visibility lag.</p>
AlloyDB Omni: same name, different product</a>
</h2>
AlloyDB Omni is the downloadable AlloyDB, a container image you run on your own infrastructure (Kubernetes, a VM, your laptop).</p>
docker</span> pull google/alloydbomni:18</span>   # or a specific tag like 18.1.1</span></span></code></pre>
One sign that Omni is a separate product is its timing. When managed AlloyDB hit PostgreSQL 18 (GA May 2026), the Omni Linux packages updated. However, the Docker Hub image lagged, staying at version 17 for a while. The release trains are separate. Check the tag you actually pull.</p>
The AlloyDB compute layer includes several components. It has a columnar engine. This engine uses the same API and includes the google_columnar_engine_*</code> relations. Also, it has the ScaNN vector index and updates to the AlloyDB planner.</p>
What's not inside is everything in the first half of this article. Omni runs on standard PostgreSQL storage. Real 8KB pages on your filesystem, WAL as a recovery mechanism, ordinary autovacuum doing ordinary VACUUM work. Start an Omni container and check pg_settings</code>. full_page_writes</code> is on</code>, and checkpoint_timeout</code> is five minutes. This means the write path handles full-page images like stock PostgreSQL.</p>
However, Omni doesn't inherit those write-path advantages. No disaggregated storage. No shared-storage read pools. Omni replicas are just plain streaming replication, with lag included. There’s no managed failover, so bring your own Patroni. The one storage-flavored feature that does come along is the ultra-fast SSD cache, and only as a knob. In Omni you point a disk cache at a local SSD and size it yourself; managed provisions and sizes it for you.</p>
Managed AlloyDB and AlloyDB Omni are different in design but share the same query layer.</strong> Omni is much closer to a PostgreSQL fork with a columnar engine bolted in than to a portable version of the cloud product. That doesn't make it uninteresting; the columnar engine on your own hardware, without GCP, stands on its own. But if the storage-layer properties are what attracted you, Omni does not have them.</p>
Omni is the clean benchmark platform for isolating the columnar engine's share of AlloyDB's analytical performance. It runs TPC-H tests with the engine off and then on. That pair is the two Omni columns in The numbers below, and it is the cleanest isolation in the exercise. Q6 falls from 2,681 ms to 69 ms with nothing changed but the engine flag.</p>
For dryrun</a> users: Use dryrun snapshot push</code> with AlloyDB Omni. It reads the standard pg_catalog</code> that AlloyDB keeps. The google_columnar_engine_*</code> relations and alloydb_ai</code> objects aren't in the snapshot schema yet. However, showing columnar-engine state in the schema advisor is planned for the future.</div>
Read pool economics</a>
</h2>
Everything the columnar section measured ended in the same place. On one machine, analytics and OLTP compete for the same compute, and no storage layout changes that. The read pool is the escape from the single machine, and it is where the shared-storage architecture starts to justify its price premium. Stock PostgreSQL can also isolate analytics using a streaming read replica. However, this replica holds a complete second copy of your data. It has some lag, needing to process a full pipeline before changes become readable. Plus, it's slow to set up, so you might end up running it all day. AlloyDB's read pool improves on all three, with a caveat on each.</p>
A pool consists of N read-only compute nodes connected to the same storage layer as the primary, with load balancing positioned in front. The three properties that set it apart from a streaming replica are economic as much as technical.</p>
The lag is a shorter pipeline, not the absence of one</strong>. A streaming replica's lag happens when WAL needs to be generated, shipped, and applied. This must occur before a change is readable. Under heavy write load, this pipeline can back up. Seconds of lag on a busy primary is normal; minutes is not rare. A read pool node runs the same pipeline over a much shorter distance. It never waits for pages, because the storage is already shared, so what it waits for is only the log.</p>
Google's troubleshooting page divides issues into two parts:</p>

Flush lag</strong> which occurs while the WAL is sent from the primary and stored on the node.</li>
Replay lag</strong> happens when the node applies the WAL.</li>
</ul>
Additionally, max_standby_streaming_delay</code> is a setting for read pool nodes, serving its usual purpose.</p>
What the shared storage buys is lag that starts small and stays small under steady load. Under a steady insert load on a two-node read pool, it reached a median of about 60 ms. This is much higher than the single-digit figure from Google. My number is an upper bound, as it factors in cross-instance clock skew and the granularity of batched commits. Over thirty samples, the median stayed stable even as the writes continued. Steady load is the whole claim, though. Google warns that a sudden rise in write workload can create many replication logs. This can overwhelm the read pool instances and lead to replication lag. Also, heavy reads on a node compete with replication for CPU and memory. My run measured the flat case and says nothing about a burst. Design for the burst case that Google warns about. Treat the 60 ms as the calm-day number. Also, reading your own writes across the pool isn’t guaranteed.</p>
You can add read capacity without re-buying storage, though not, as I first assumed, because read pool vCPUs are cheaper. They bill at the same per-vCPU and per-GB rate as the primary, with no read-pool discount. The saving sits on the storage side. A read pool node adds compute against the same stored copy of your data. A Cloud SQL read replica is a full separate instance with its own full copy of storage, so each replica you add re-pays for the data. For read-heavy tasks like dashboards and reporting, lag in the tens of milliseconds is key. It's a stronger point than the 100x headline. The storage-duplication saving is real too, but as the numbers below show, it only turns into a smaller bill at large scale.</p>
List-price math, per node at 8 vCPU, includes one primary and two read nodes. These are monthly US list prices before any committed-use discounts. Prices can vary by 20 to 40 percent by region.</p>
</th> compute per node</th> storage</th> primary + 2 read nodes</th></tr></thead>

Cloud SQL PG (8 vCPU / 52 GB)</td> ~$507</td> $0.22/GB, per instance</td> 3x compute, 3x storage</td></tr>
AlloyDB (8 vCPU / 64 GB)</td> ~$1,028</td> $0.34/GB, shared once</td> 3x compute, 1x storage</td></tr>
</tbody></table>
The two effects work against each other. AlloyDB uses one storage copy for the entire pool, while Cloud SQL makes duplicates for each replica. This means AlloyDB saves two storage copies. However, an AlloyDB node costs about twice as much as a Cloud SQL instance with the same core count. It also has a higher per-vCPU rate, with memory fixed at 8 GB per vCPU. Compute costs dominate until the data size increases. If the read nodes run continuously, the two setups break even at around 5 TB</strong> of storage. Below that, Cloud SQL is cheaper, costing about 40 percent less at a typical 500 GB.</p>
A flat, round-the-clock approach is what a read pool aims to avoid. This is where Cloud SQL falls short. Cloud SQL can’t autoscale its replica count. It prepares for its busiest hour and charges for that every hour, even when no queries run overnight. In contrast, an AlloyDB read pool adapts to demand. It adjusts node count based on load, so you only pay for the node-hours you actually use. The cost isn’t based on data size, but on the day’s bursty nature. It reflects the average node count compared to the peak.</p>
Consider a business-hours pattern: three read nodes during the 9-to-6 peak, one on the edges, and none overnight. This setup averages 1.4 nodes, while Cloud SQL keeps three nodes active all day. A three-node pool running flat all day breaks even at about 3.9 TB. With the business-hours shape, the break-even drops to around 765 GB. Make the day even peakier, and the benefits increase. When this three-node pool averages less than a third of its peak, AlloyDB becomes cheaper at any dataset size. Its part-time compute costs less than the storage it doesn’t duplicate.</p>
</a>
</a></p>
The curve divides the chart in two. Above it, the shared-storage savings exceed AlloyDB's compute premium, making the pool cheaper. Below it, Cloud SQL's cheaper compute still wins. The curve goes up to the right. The flatter your read load is, the more data you need. This is necessary before the storage savings outweigh AlloyDB's compute cost. Your workload is marked on this chart. More terabytes push it up, while a burstier day shifts it left. Both factors move it closer to AlloyDB's side of the line. Below about a third of peak the curve leaves the bottom of the chart entirely, and AlloyDB is cheaper at any size.</p>
The arithmetic per node at 8 vCPU includes one primary and a read pool, calculated monthly for the US. Let n represent the peak read-node count and r be the pool's average-to-peak load factor.</p>
Cloud SQL provisions for peak usage around the clock with the formula: (1+n)·$507 + (1+n)·$0.22·S. In contrast, AlloyDB pays for average node-hours over shared storage: $1028 + r·n·$1028 + $0.34·S. </p>
Setting these equal provides the break-even storage: S* = (521 − 507·n + 1028·r·n) / (0.22·n − 0.12) GB. This is the curve shown above, and the generator is in the repo.</p>
</div>
AlloyDB automates this process. Its read pool autoscaling adjusts the node count based on CPU usage, a schedule, or both. This means you can activate low-duty-cycle mode as a policy, not through complex scripts. Cloud SQL does not have a similar feature for replica counts.</p>
Two important points apply here. First, when you add a new node, it starts cold. This means it gradually earns its capacity instead of doing it all at once. The buffer cache fills up over a few minutes. During this time, scans that would normally pull from memory must retrieve data from storage. That’s why autoscaling works better for steady reads throughout the business day than for sudden spikes.</p>
Second, the autoscaler adds nodes without shifting existing long-lived connections. If a session opened a connection and keeps it, that connection stays where it is. The new capacity is only used when clients reconnect. AlloyDB’s managed PgBouncer in transaction mode helps with this, spreading new connections across the pool as nodes come and go. Short-lived pooled connections utilize the new nodes, while long-held sessions leave them unused.</p>
So, the recommendation depends on read patterns. If reads are steady all day and data is under a few terabytes, Cloud SQL replicas are more cost-effective. For bursty reads, like business-hour dashboards or nightly reports, AlloyDB’s autoscaling read pool is cheaper and self-scaling.</p>
If your reporting can handle a few seconds of lag, streaming replication is fine. You can skip this section.</p>
AlloyDB AI: the part that's interesting without GCP</a>
</h2>
A quick disclosure.</strong>I’m confident with relational internals, but high-dimensional ANN indexing (pgvector, HNSW, ScaNN) is still new to me.</p>
Running into silent query knobs and limits on graph builds showed that vector intuition is a different skill. So, think of these numbers as an empirical field report, not a full AI benchmark.</p></div>
Every managed PostgreSQL has pgvector now. AlloyDB stands out because of ScaNN. This is Google’s approximate-nearest-neighbor algorithm. It powers their internal search and comes as a PostgreSQL index access method. It works with pgvector’s `ivfflat` and `hnsw`.
-- pgvector HNSW, available everywhere</span></span>
CREATE INDEX</span> ON</span> embeddings </span>USING</span> hnsw (embedding vector_cosine_ops);</span></span>
</span>
-- AlloyDB ScaNN (verified on Omni; sq8 quantization keeps the index small)</span></span>
CREATE INDEX</span> ON</span> embeddings </span>USING</span> scann (embedding cosine)</span></span>
WITH</span> (num_leaves </span>=</span> 1000</span>, quantizer </span>=</span> 'sq8'</span>);</span></span>
-- query-time recall/latency knob. The LOAD is not optional: without it the SET</span></span>
-- silently does nothing and the search runs at a shallow default (see below).</span></span>
LOAD</span> 'alloydb_scann'</span>;</span></span>
SET</span> scann</span>.</span>num_leaves_to_search</span> =</span> N;</span></span>
</span>
-- The query doesn't change; the planner picks the index</span></span>
SELECT</span> id, content </span>FROM</span> embeddings</span></span>
ORDER BY</span> embedding </span><=></span> '[0.1, 0.2, ...]'</span></span>
LIMIT</span> 10</span>;</span></span></code></pre>
The claim to test is that with tens of millions of vectors, ScaNN maintains high recall while reducing query latency. In contrast, HNSW starts to cost a lot in memory and build time. I ran it at 10M vectors of 1024 dimensions, cosine distance, against exact ground truth. The cost half of that claim holds, and holds convincingly. I couldn't settle the recall half, and the reason is more important than the number.</p>
The half that holds is index size and build time. ScaNN's sq8-quantized index came to 2.6 GB against ivfflat's 76 GB, roughly thirty times smaller, and built in six to seven minutes against fifty-three. Both runs of the harness put the index sizes within a megabyte of each other and ivfflat's build within half a percent; ScaNN's own build time varied more between them, 357 seconds and 437 seconds, so call the build advantage seven to nine times rather than a single figure.</p>
One of the issues that surprised me is query-time setting scann.num_leaves_to_search</code>. It only works if alloydb_scann</code> is loaded first; otherwise, it defaults to a shallow search. Adding the library to shared_preload_libraries</code> causes server restart failures. The only reliable method is loading it per session. My initial 10M run requested a deep search but returned a recall of 0.15, with no indication that the knob was ignored. I won't report the recall figure since my runs disagreed, and the test to clarify this never happened. I’ll focus on ScaNN's claim of maintaining recall at deeper levels, but I trust it the least. Proper testing should plot recall against search depth with your own data; I’d prioritise index size and build time instead.</p>
At the end I didn't manage to get a clean 10M build number for hnsw using this setup. The parallel build hit resource limits. One attempt faced disk issues, while another had a shared-memory segment that was too small. This shows that building a full-precision graph over ten million high-dimensional vectors is costly.</p>
Therefore, the scorecard is shorter than the datasheet and less detailed than I wanted. ScaNN's index excels in size and build time, showcasing solid engineering through a standard PostgreSQL interface. I leave its recall claim open. Both index builds, the ivfflat baseline (76 GB, 53 minutes) and the log of the disrupted run, are in the repo.</p>
ScaNN ships with Omni, so it doesn’t need managed AlloyDB or GCP. The other part of AlloyDB AI, the google_ml_integration extension, which calls Vertex AI models from SQL, does require them.</p>
-- model id is a current Vertex model: text-embedding-005 (English/code, 768d) here;</span></span>
-- gemini-embedding-001 is the higher-quality, higher-dimension option</span></span>
SELECT</span> id, </span>google_ml</span>.</span>embedding</span>(</span>'text-embedding-005'</span>, content) </span>AS</span> vec</span></span>
FROM</span> documents;</span></span></code></pre>
If you're on GCP and already call Vertex, that saves a data round-trip. If you're not, it does nothing for you.</p>
Cross-region: DR, not active-active</a>
</h2>
AlloyDB allows up to five secondary clusters in different regions. Google reports replication lag in the tens of milliseconds. It looks like cross-region HA, and it is, within one constraint: writes go to the primary region, always. Secondaries are read-only until promoted, and the two promotion paths are not interchangeable.</p>
Failover (DR promotion)</strong>. The secondary declares itself primary and starts taking writes. Whatever WAL was in flight and unconfirmed when the old primary died is gone. This is the path for "the region is down and we accept the loss window."</p>
Switchover is coordinated</strong>. Drain the primary, confirm the secondary is caught up, swap roles. Zero loss, but both sides must participate.</p>
An active-active deployment  does not exist.If your architecture requires writes in multiple regions, AlloyDB isn't the solution. The documentation is clear about this. The key risk to avoid is human error. This happens when an operator promotes a system during a minor issue, incurring data loss. A proper switchover would have managed this situation smoothly.</p>
What "fully compatible" actually covers</a>
</h2>
As already mentioned - "fully compatible with PostgreSQL" means AlloyDB uses the PostgreSQL wire protocol and runs its SQL dialect. psql</code>, libpq</code>, JDBC, psycopg, the ORMs all work, and that's not nothing; it's the difference between migrating and rewriting.</p>
Here is what it does not mean.</p>
AlloyDB is not community PostgreSQL.</strong> It’s a Google fork with unique changes, including a columnar engine and planner updates, which aren’t shared with the community. The storage interface is tied to Google’s infrastructure. While Cloud SQL uses upstream PostgreSQL, AlloyDB modifications remain in the fork. AlloyDB matches community releases closely: PostgreSQL 18 reached GA on AlloyDB in May 2026, within months of the community release. Upgrades from older versions are easy, but security and behavioural fixes come solely from Google’s fork.</p>
Extensions are an allowlist</strong>, and the allowlist differs between the two products in ways you would not guess. Managed AlloyDB's approved set is generous for the mainstream, and the Omni image ships its own bundle; they are not the same bundle. Compare the Omni Docker image contents (from pg_available_extensions) with the managed supported list.</p>
extension</th> Omni image</th> Managed AlloyDB</th></tr></thead>

pg_stat_statements, pg_repack, pg_partman</td> ships</td> yes</td></tr>
pgaudit, pg_cron</td> ships</td> yes, behind a flag</td></tr>
postgis</td> not bundled</strong></td> yes</td></tr>
plv8</td> ships (3.2.3)</strong></td> no</strong></td></tr>
timescaledb</td> not bundled</td> no</td></tr>
pgvector, hstore, pg_trgm, pgcrypto, uuid-ossp</td> ships</td> yes</td></tr>
</tbody></table>
Two counterintuitive points: plv8</code> is included in the Omni image but not on the managed allowlist, making "AlloyDB supports plv8" true for Omni and false for managed. Conversely, postgis</code> is supported by managed but not included in Omni, requiring manual installation. "Built for PostgreSQL 18" doesn't guarantee compatibility with AlloyDB Omni 18. timescaledb</code> is unsupported on both.</p>
AlloyDB Omni added Transparent Data Encryption (TDE) in preview (Omni 18.1.0). This feature provides cluster-level at-rest encryption. It also supports keys in external KMS, such as HashiCorp Vault. In contrast, community PostgreSQL lacks built-in TDE, relying instead on filesystem encryption or pgcrypto</code>. Managed AlloyDB uses standard cloud at-rest encryption with Cloud KMS. The Omni feature is important. It adds a debated capability to self-hosted builds. This is similar to the changes seen in the columnar engine and planner.</p>
The config surface is curated too. There is no postgresql.conf</code> and no pg_hba.conf</code>; parameters are exposed (or not) through the GCP console and API, and ALTER SYSTEM</code> is not yours to run. Most teams won’t miss the hidden flags. However, teams that carefully tune PostgreSQL will quickly notice which ones are missing. The storage works similarly: pageinspect</code>, WAL inspection, and anything that deals with the physical format is either removed or has a new meaning. So, you rely on AlloyDB's insights about what happens below the buffer pool.</p>
Two bundled features, neither a differentiator. The index advisor is proprietary pg_qualstats</code> plus hypopg</code>, always-on, pushing recommendations to Cloud Monitoring. Useful if you don't already analyze indexes yourself. Managed PgBouncer is also included, defaulting to transaction mode with the same old caveats: PREPARE</code>, LISTEN</code>, SET</code>, temp tables, and advisory locks still break. Session mode fixes this but undoes most of the pooling. Omni users run their own PgBouncer.</div>
The version story is a genuine strength, though. AlloyDB tracks new majors fast and ships one-click in-place upgrades, and it keeps old majors alive past community EOL. Both ends of that range are real enterprise value. You are neither forced onto a migration on the community's clock nor stranded on a version the community has dropped.
The fixes for your version, including new-major support and extended-support patches, come from Google. They are for Google's fork since that's the code you are using.</p>
The governance question</a>
</h2>
This part of the evaluation bothered me the most, and it's the hardest to benchmark. PostgreSQL is more than just source code. It’s a development process. There are public mailing lists for design talks, commit messages that explain choices, and release notes that track changes in behaviour. Plus, there’s a 30-year history that anyone can read. When PostgreSQL surprises you, you can trace back to the thread where the decision was made.</p>
Google does invest in that process, and it is worth being honest about how.</p>
Google shares</a> that it employs key PostgreSQL contributors. Their latest work is open for all to see. This includes:</p>

Design and review of PostgreSQL 18's native conflict detection for logical replication.</li>
The long-awaited logical replication of sequences.</li>
Fixes for core deadlocks and upgrade bugs.</li>
A spot on the PGConf.dev 2026 program committee.</li>
</ul>
The contribution stops short of AlloyDB itself, though. A search of the pgsql-hackers archives</a> for "AlloyDB" still returns zero hits, and that is not a quirk of branding. Google's upstream work is standard PostgreSQL. It’s contributed under individual and Google Cloud names, benefiting everyone. The architecture that makes AlloyDB AlloyDB is developed entirely outside that work, and proposed to the community nowhere.</p>
Aurora and Azure's PostgreSQL services are similar. This section applies to both, differing only in serial numbers. Choosing either means selecting a vendor as your database governance authority instead of the PostgreSQL community. This decision should be clearly noted in your architecture decision record.</p>
The PG Scorecard (pgscorecard.com</a>, open source) scores feature conformance to community PostgreSQL across twelve categories, each marked full, partial, or none and rolled into one weighted percentage. It is the right tool for its question, does this engine speak PostgreSQL's SQL, and a fair answer to vendors who overclaim it. The single number is also its limit. A 93 for AlloyDB and a 100 for a distributed fork flatten exactly the architectural and governance differences this post spent its length drawing. Read it as the protocol-layer axis of a fuller picture.</div>
One observation follows from the architecture itself. The wire protocol is now the only stable boundary. Tools that operate there, like schema introspection via pg_catalog</code>, migration planners, and connection proxies, work the same with AlloyDB. This is because Google has promised to keep that layer stable. Tools that reach below it break. As more of the fleet moves onto wire-compatible-but-divergent engines, the protocol-and-catalog layer is becoming the de facto portability standard, more durable than the "it's PostgreSQL" label, which increasingly just means the PostgreSQL wire protocol.</p>
The community could enhance Mayur's PostgreSQL Compatibility Index, which already exists. The PG Scorecard rates vendors, with AlloyDB scoring about 93%. This score reflects SQL compatibility but doesn't assess the storage engine or operational aspects. The article and score aren't conflicting; they evaluate different layers. What's needed is a matrix for the underlying components, including extension portability and governance transparency. Each engine would have varied scores, and combining both matrices would provide greater insight than either alone. This could be a great topic for a pgConf talk.</p>
When AlloyDB makes sense</a>
</h2>
Marketing aside, the decision is more tractable than the feature list makes it look.</p>
A good fit</strong> comes when:</p>


You're already on GCP and want the infrastructure chores gone. Failover is seamless since there’s shared storage and no WAL to replay. Storage expands automatically without needing resize windows. Plus, the write path avoids PostgreSQL's full-page-write cost in the managed service. Three concrete wins, and none of them costs you a config knob</p>
</li>

HTAP load allows for fast reporting and analytics on live data. The columnar engine speeds up scans, bypassing the warehouse, while a read pool node separates these from OLTP writes. This combination of quick analytics on the main node and distinct compute on a shared-storage read node is challenging to achieve with standard PostgreSQL.</p>
</li>

Your read-heavy workload needs replica freshness in tens of milliseconds, while a streaming replica can take seconds. You can accept a wider boundary during write bursts. The read pool’s costs work for your needs. If you have multi-terabyte data or bursty reads, you can autoscale down. For flat 24/7 reads under a few terabytes, Cloud SQL remains cheaper, as noted above.</p>
</li>

You want the columnar engine without GCP; that's Omni, knowing it's the query layer only</p>
</li>
</ul>
Not so good fit</strong>:</p>


You depend on extensions off the allowlist: timescaledb</code>, plv8</code>, anything pgrx, anything superuser</p>
</li>

Your tuning, tooling, or debugging relies on upstream PostgreSQL behaviour below the protocol. This includes config access, storage inspection, or WAL tooling.</p>
</li>

Major-version upgrades need to happen on your schedule</p>
</li>

You need active-active across regions</p>
</li>

You're not on GCP and were considering managed AlloyDB; that's GCP-only, and everywhere else means Omni, which is different product (see above)</p>
</li>
</ul>
The columnar engine justifies its memory use when analytical queries scan millions of rows for a few columns. This makes scans faster. However, it doesn't isolate these scans from concurrent writes; that's the read pool's role on a separate node. Use both together. It’s not effective for index-served workloads, point lookups, or small tables in the buffer pool. It can also be expensive for write-heavy tables with pinned columns. See the numbers below for crossover points.</p>
The numbers</a>
</h2>
TPC-H scale factor 10, median of 5 warm runs, one cold run dropped, all on 8 vCPU / 64 GB in the same region. Times in milliseconds. Two parity gaps are worth naming rather than burying: standard PG is 18.4 while Omni is 17.7, because the Docker image lagged a major at the time, and Omni auto-tunes shared_buffers</code> to about 47 GB where the native instance ran 16 GB. I ran Omni at both sizes to check whether the second one mattered, and it doesn't move anything material: Q6 is 2,592 ms at 16 GB against 2,681 ms at 47 GB. Both gaps are real, both are in the repo, and neither carries the result. The two Omni columns represent the clean experiment. They use the same binary and storage. One has the columnar engine off, while the other has it on.</p>
query</th> standard PG 18</th> Omni, engine off</th> Omni, engine on</th> managed AlloyDB</th></tr></thead>

Q1</td> 11,969</td> 14,056</td> 10,159</td> 9,922</td></tr>
Q5</td> 2,496</td> 2,374</td> 1,870</td> 1,521</td></tr>
Q6</td> 2,669</td> 2,681</td> 69</td> 62</td></tr>
Q12</td> 2,357</td> 2,909</td> 706</td> 682</td></tr>
Q14</td> 1,293</td> 1,005</td> 555</td> 481</td></tr>
Q18</td> 34,301</td> 29,924</td> 26,168</td> 31,353</td></tr>
point lookup</td> 0.107</td> 0.096</td> 0.119</td> 0.120</td></tr>
</tbody></table>
Read the two Omni columns across. Q6, a selective scan of a few columns, drops from 2,681 ms to 69 ms, 39x. Q12 drops 4.1x and Q14 1.8x, both joins with date filters. Q1 moves 1.4x because it sums four numeric</code> columns over nearly every row and the arithmetic dominates. Q18, an uncorrelated IN</code> subquery, moves 1.14x, the smallest win in the set. The point lookup stays put: 0.096 ms with the engine off against 0.119 with it on, and at SF100 it goes the other way, 0.15 against 0.11. Both differences are a few hundredths of a millisecond, which is noise on a query this small. The planner uses the b-tree, and the columnar store doesn’t affect the plan.</p>
Managed AlloyDB (engine on) tracks self-managed Omni almost exactly: Q6 62 vs 69 ms, Q12 682 vs 706, Q14 481 vs 555. The columnar engine behaves the same whether Google runs it or you do, which is the confirmation that the result isn't an artifact of one deployment.</p>
This table hides two key points. First, "standard PG 18" is a hand-tuned native instance. Running the same query on Cloud SQL with default settings (work_mem=4MB</code> and two workers per gather) takes 12,436 ms for Q5. This gap is due to a config default, not the engine. It’s the cost that every managed-Postgres comparison faces; it’s noted in the repo as B-stock</code>.</p>
Second, at SF10, the whole dataset fits in RAM for every config. Here, the columnar advantage comes from vectorized execution and skipped columns, since there’s no disk access. At SF100, where the row store spills to disk, Q6's 39x becomes 311x (the plans are in the columnar section above).</p>
The two controls the engine has to not</em> lose:</p>
INSERT throughput</strong>. Loading one million rows into lineitem</code> with its columns pinned into the columnar store, versus not: 1,859 ms pinned, 1,842 ms unpinned. About 1% to keep the columnar blocks coherent, at this write rate. A write-hot table taking thousands of INSERTs a second is where that cost grows; this measures the quiet end of it.</p>
Concurrency and HTAP</strong>. On Omni, writes with pgbench and a concurrent analytical scan on the same table show a 13.6% drop in write throughput for row store and 13.5% for columnar store. The columnar engine, meant to reduce contention, didn't help because the scanned table was in memory, eliminating disk wait times. Both scans used CPU and memory bandwidth on the same node as the writes, causing the drop.</p>
To prevent analytical scans from affecting OLTP throughput on AlloyDB, route them to a separate read pool node, accepting visibility lag instead of reduced write throughput.</p>
Testing at SF100 with a 600-million-row lineitem revealed that the disk-bound row-store scan reduced write throughput by 16%, while the in-memory columnar scan dropped it by 29%. Columnar scans, though cheaper and CPU-efficient, increased contention by consuming more memory bandwidth on the write node. Thus, physical isolation on separate hardware is necessary for effective resource management. Each configuration's results were based on median values from three 120-second runs, with raw data available in the repo.</p>
Read pool lag. Under a sustained insert load, a two-node read pool trailed the primary by a median of about 60 ms and, across thirty samples, did not climb as the writes continued (raw samples in the repo). The flat-under-sustained-load shape is the finding, not the absolute value. What this run does not cover is a write burst, which Google documents as able to overwhelm a pool's replication, or a head-to-head against Cloud SQL.</p>
Methodology, raw timings, and EXPLAIN ANALYZE output for every number is available at https://github.com/boringSQL/alloydb-evaluation-bench. If a result doesn't reproduce for you, that's a bug in the article; file an issue.</p>
What Google got right, and what it costs</a>
</h2>
Adaptive autovacuum is a smart scheduler. It speeds up when the instance is idle and slows down when it’s busy. This feature addresses the common issue of vacuum debt in PostgreSQL. It automates tasks that users usually have to tune manually. It does not move the work off the compute node, whatever the pitch implies. It makes the box smart enough that the scheduling stops being your problem.</p>
The read pool model offers a fairer price for read scaling compared to the replica model. This fairness increases as you expand. ScaNN, as an index access method, is robust engineering. It’s available through a standard interface in Omni, without any GCP charges. The team behind this has a deep understanding of PostgreSQL and knows what users can do without.</p>
What it costs is the other half of this post. PostgreSQL in AlloyDB covers the protocol, dialect, and planner's behaviour. Google owns the storage engine, operational model, upgrade schedule, extension surface, and governance.</p>
The boring answer, as always, is to test it against your workload. The TPC-H numbers above show the columnar engine's best case. Even then, two results didn’t match the datasheet. When the heap spilled to disk, enabling the columnar engine increased write contention to 29%, compared to 16% for the row store. Also, ScaNN’s key query-time knob is inactive unless you LOAD</code> the library first. This cost me a ten-million-vector run and yielded only 0.15 recall, with no warning. Both issues took time to discover, and neither is mentioned in any marketing.</p>
Disclaimer</a>
</h2>
The article hasn’t been reviewed or edited by Google Cloud team. I asked for internal insights but haven’t received them for various reasons. The benchmark repository was developed over an extended period of timeand is managed using Claude Code. My company - Clusterity s.r.o. - have covered all costs related to the benchmarking.</p>
The work on this article spanned between April to August 2026. Preceded by the evaluation of the commercial workloads.</p>


Don't let AI touch your production database
2026-04-06T22:24:00+02:00
Not so long ago, the biggest threat to production databases was the developer who claimed it worked on their machine. If you've attended my sessions, you know this is a topic I'm particularly sensitive to.</p>
These days, AI agents are writing your SQL. The models are getting incredibly good at producing plausible</em> code. It looks right, it feels right, and often it passes a cursory glance. But "plausible" isn't a performance metric, and it doesn't care about your execution plan or locking strategy.</p>
AI-generated SQL is syntactically correct, which is the easy part. The hard part is knowing what a statement does</em> to a running system: which locks it takes, how long it holds them, whether it rewrites the table on disk.</p>
The spectacular failures get the headlines. In July 2025, an AI coding agent wiped a production database</a> during a code freeze -- ran destructive commands, panicked, then lied about what it had done.</p>
But the biggest damage is quieter. It's the migration that passes every test, ships through CI and then locks a production table during peak traffic. The query written with random assumptions. Indexes added based on copy/paste from psql</code>. The cumulative effect that builds over time, when nobody is looking.</p>
How to give AI agent "eyes"</a>
</h2>
When you're running Claude Code or any other agentic coding tool, the bottleneck isn't the model's intelligence. It's the fidelity of the environment. Standard AI coding involves the agent guessing column names based on your description, or in better cases parsing a schema.sql</code> file or using a local database with seed data.</p>
None of these give the agent the one thing it actually needs: awareness of your production</em> schema. The table sizes, the indexes, the constraints, the statistics that determine whether a query index-scans in 2ms or sequential-scans for 40 seconds.</p>
The obvious fix is to give it a database connection. Let it query pg_catalog</code>, read table sizes, check existing indexes. This is how Anthropic's reference PostgreSQL MCP server worked, and that's the one Datadog Security Labs found a SQL injection in</a>. The vulnerable npm package still gets 21,000 downloads per week. The server wrapped queries in read-only transactions, but accepted semicolons. COMMIT; DROP SCHEMA public CASCADE;</code> works because the COMMIT</code> ends the read-only transaction and everything after runs with full privileges. Read-only transactions are not a security boundary when the protocol accepts semicolons.</p>
The AI doesn't need a connection</em>. It needs the information</em>. Schema metadata is structural data. You can extract it once, save it as a JSON file, commit it to git, and hand that file to every tool in your stack.</p>

MCP</a> is an open standard for connecting AI assistants to external tools and data sources. Instead of relying on training data, the agent calls structured tools exposed by an MCP server and gets deterministic answers back.
</div>
What's been missing is a standard way to wire that information into the agent's workflow. Not a one-time dump that sits in a docs folder, but a protocol that lets the agent call tools</em> and get structured answers back. That protocol is MCP</a> (Model Context Protocol).</p>
What are PostgreSQL MCP servers actually for?</a>
</h2>
This has been bugging me. If you search for "PostgreSQL MCP server" today, you'll find two kinds.</p>
The first is a connection wrapper. You give it a DATABASE_URL</code>, it exposes tools like query</code> and execute</code>. This is psql</code> with extra steps. The Anthropic reference server that got the SQL injection? Connection wrapper. The dozen community forks that replaced it? Connection wrappers with slightly better input validation.</p>
The second is a managed-provider gateway. Cloud database platforms expose their platform APIs through MCP. Create a branch, provision a database, manage users. Useful if you're on that platform, but not database intelligence. Control-plane operations wearing a protocol hat.</p>
Neither kind answers the question an AI agent actually needs answered: "is this SQL going to be a problem?"</em></p>
A connection wrapper can run EXPLAIN</code>, if you trust it with credentials. But who tells the agent that SET NOT NULL</code> on a 4-million-row table takes an ACCESS EXCLUSIVE</code> lock? Who tells it that its query defeats partition pruning? That's not a connection problem. It's a knowledge problem.</p>
dryrun</a>
</h2>
I didn't set out to build an AI tool. My primary project is RegreSQL</a>, a statistics-based SQL regression testing framework. RegreSQL needs production statistics to produce realistic query plans in test environments, and dryrun's schema capture was originally just the plumbing to get those statistics into the right place.</p>
But driving adoption of a testing tool is hard. The best place to plug in is where the coding actually happens. And these days, that's increasingly AI agents. Instead of fighting it, I turned the plumbing into a proper tool.</p>
dryrun</a> is a PostgreSQL schema intelligence tool. It ships as a CLI and as an MCP server. It doesn't connect to your database at runtime. Instead, it works from a JSON snapshot of your schema, captured once, committed to git, and available to everyone.</p>
Offline first</a>
</h3>
One person with production access captures the schema:</p>
dryrun</span> dump-schema</span> --source</span> "</span>$PROD_URL</span>"</span> --pretty --name</span> "production"</span> -o</span> schema.json</span></span></code></pre>
The JSON contains everything structural: tables, columns, constraints, indexes, and the rest of what you'd find in pg_catalog</code>. It also captures per-table statistics from pg_statistic</code> (histograms, most common values, correlation, n_distinct</code>) and runtime counters from pg_class</code> like reltuples</code>, seq_scan</code>, and idx_scan</code>. One file, typically 200-500KB. Structural metadata, not row data.</p>

If your schema uses COMMENT ON</code> (and it should), dryrun captures those too. A column named status</code> is ambiguous. COMMENT ON COLUMN orders.status IS 'pending | completed | refunded, set by payment processor webhook'</code> tells the agent what the values mean, where they come from, and that it shouldn't invent new ones.
If you don't take my word for it, check what Bruce Momjian has to say</a> about it. MCP clients can only work with schemas, object names, and constraints. Comments are the simplest way to supply the semantic context that makes AI-generated queries meaningful.</p>
</div>
Import it and every subsequent command works offline:</p>
dryrun</span> import schema.json</span></span></code></pre>
No connection needed, no credentials on developer machines or in CI.</p>
As an MCP server</a>
</h3>
claude</span> mcp add dryrun</span> --</span> dryrun mcp-serve</span></span></code></pre>
Claude now has 16 tools for exploring your schema, validating queries, checking migrations, and suggesting improvements, all from the offline snapshot.</p>
What the agent gets</a>
</h3>
dryrun exposes 16 tools through MCP. The four that matter most for the argument in this article:</p>
check_migration</strong> is the one I find myself using most often, even outside of AI workflows. It analyzes DDL statements for lock implications, table rewrites, and version-specific behavior, and returns the safe multi-step alternative when one exists. Every migration example in this article was caught by this tool.</p>
suggest_index</strong> reads column statistics from the snapshot and recommends indexes informed by your actual data distribution. Not "add an index on this column" but "add a partial index on the 3% of rows that match your query pattern." It also uses correlation data to recommend BRIN indexes where appropriate: 3MB instead of 400MB for a B-tree on a column with near-perfect insertion order.</p>
validate_query</strong> parses SQL against the schema snapshot without executing it. It catches references to tables and columns that don't exist, detects anti-patterns, and flags issues before the query goes anywhere near the database.</p>
lint_schema</strong> runs 18 convention rules and 14 structural audit checks: naming, types, constraints, timestamps, partition health, duplicate indexes, foreign key columns missing indexes, tables without primary keys. All disableable in dryrun.toml</code>, because not every convention fits every project.</p>
The remaining tools cover schema exploration (list_tables</strong>, describe_table</strong>, search_schema</strong>, find_related</strong>), operations (compare_nodes</strong>, detect</strong>, vacuum_health</strong>), execution plans (explain_query</strong>), and schema maintenance (refresh_schema</strong>, check_drift</strong>). The full list is in the documentation</a>.</p>
Try it yourself</a>
</h2>
Here's a schema and seed data you can run in any local PostgreSQL:</p>
CREATE TABLE</span> customers</span> (</span></span>
    id </span>bigint GENERATED ALWAYS AS IDENTITY PRIMARY KEY</span>,</span></span>
    name text NOT NULL</span>,</span></span>
    email </span>text</span>,</span></span>
    created_at </span>timestamptz NOT NULL DEFAULT now</span>()</span></span>
);</span></span>
</span>
CREATE TABLE</span> orders</span> (</span></span>
    id </span>bigint GENERATED ALWAYS AS IDENTITY PRIMARY KEY</span>,</span></span>
    customer_id </span>bigint NOT NULL</span>,</span></span>
    status text NOT NULL DEFAULT</span> 'pending'</span>,</span></span>
    total_amount </span>numeric</span>(</span>10</span>,</span>2</span>),</span></span>
    created_at </span>timestamptz NOT NULL DEFAULT now</span>()</span></span>
);</span></span></code></pre>
Seed it with data that has the distributions that matter, like skewed status values and nullable emails:</p>
-- 100K customers, ~5% with NULL email</span></span>
INSERT INTO</span> customers (</span>name</span>, email, created_at)</span></span>
SELECT</span></span>
    'customer_'</span> ||</span> i,</span></span>
    CASE WHEN</span> random()</span> <</span> 0</span>.</span>05</span> THEN NULL</span></span>
         ELSE</span> 'user'</span> ||</span> i </span>||</span> '@example.com'</span></span>
    END</span>,</span></span>
    '2023-01-01'</span>::</span>timestamptz +</span> (i </span>||</span> ' seconds'</span>)::interval</span></span>
FROM</span> generate_series</span>(</span>1</span>, </span>100000</span>) </span>AS</span> i;</span></span>
</span>
-- 1M orders, 97% completed / 3% pending</span></span>
INSERT INTO</span> orders (customer_id, </span>status</span>, total_amount, created_at)</span></span>
SELECT</span></span>
    1</span> +</span> (random()</span> *</span> 99999</span>)::</span>int</span>,</span></span>
    CASE WHEN</span> random()</span> <</span> 0</span>.</span>03</span> THEN</span> 'pending'</span></span>
         ELSE</span> 'completed'</span></span>
    END</span>,</span></span>
    (random()</span> *</span> 500</span>)::</span>numeric</span>(</span>10</span>,</span>2</span>),</span></span>
    '2024-01-01'</span>::</span>timestamptz +</span> (i </span>||</span> ' seconds'</span>)::interval</span></span>
FROM</span> generate_series</span>(</span>1</span>, </span>1000000</span>) </span>AS</span> i;</span></span>
</span>
ANALYZE;</span></span></code></pre>
Now capture the schema for dryrun and install it as an MCP server:</p>
dryrun</span> dump-schema</span> --source</span> "</span>$DATABASE_URL</span>"</span> -o</span> schema.json</span></span>
dryrun</span> init</span></span>
dryrun</span> import schema.json</span></span>
claude</span> mcp add dryrun</span> --</span> dryrun mcp-serve</span></span></code></pre>
Open Claude Code and try these prompts. First without the dryrun MCP server, then with it.</p>
"Add an index to speed up queries that filter orders by status"</a>
</h3>
Without dryrun, Claude sees a text</code> column and does the obvious thing:</p>
CREATE INDEX</span> idx_orders_status</span> ON</span> orders (</span>status</span>);</span></span></code></pre>
A full B-tree index on 1 million rows. It works, but 97% of those rows are 'completed'</code> and nobody queries for completed orders.</p>
With dryrun, Claude calls suggest_index</strong>, sees most_common_freqs</code> showing 'completed'</code> at 97% and 'pending'</code> at 3%, and suggests:</p>
CREATE INDEX</span> idx_orders_status_pending</span> ON</span> orders (</span>status</span>)</span></span>
    WHERE status =</span> 'pending'</span>;</span></span></code></pre>
The full index maintains 1 million entries. The partial index maintains 30,000. Every INSERT that creates a 'completed'</code> order no longer pays for index maintenance it'll never use.</p>
"Make the email column on customers required"</a>
</h3>
Without dryrun, Claude writes a single statement and moves on:</p>
ALTER TABLE</span> customers </span>ALTER</span> COLUMN email </span>SET NOT NULL</span>;</span></span></code></pre>
This fails immediately because 5% of rows have NULL emails. Claude didn't know the data existed. Even if the column had no NULLs, the statement would still take an ACCESS EXCLUSIVE</code> lock and perform a full table scan to verify.</p>
With dryrun, Claude calls check_migration</strong> and describe_table</strong>. It sees 100,000 rows, knows the column is nullable, and knows from the statistics that NULLs exist. It generates a three-step migration:</p>
-- Step 1: backfill NULLs</span></span>
UPDATE</span> customers</span></span>
    SET</span> email </span>=</span> 'unknown-'</span> ||</span> id </span>||</span> '@example.com'</span></span>
    WHERE</span> email </span>IS NULL</span>;</span></span>
</span>
-- Step 2: add constraint without full table scan</span></span>
ALTER TABLE</span> customers</span></span>
    ADD CONSTRAINT</span> customers_email_not_null</span></span>
    CHECK</span> (email </span>IS NOT NULL</span>) </span>NOT</span> VALID;</span></span>
</span>
-- Step 3: validate in the background with a weaker lock</span></span>
ALTER TABLE</span> customers</span></span>
    VALIDATE </span>CONSTRAINT</span> customers_email_not_null;</span></span></code></pre>
The first step handles the data. The second adds the constraint without scanning existing rows. The third validates with a weaker lock that allows concurrent reads and writes. Three statements instead of one.</p>
Keeping the snapshot fresh</a>
</h2>
dryrun is only as good as your last snapshot. If the schema changed yesterday and nobody re-dumped, the agent is working from stale data. The check_drift</strong> tool can detect this, but only if someone runs it.</p>
The best approach is to treat schema snapshots like you treat production backups: automate them. If you're already capturing production schema dumps on a schedule, add dryrun to the same pipeline. A nightly dump-schema</code> from the primary gives you current structure and statistics. If you run read replicas with different workloads, add --stats-only</code> dumps from each node for higher-fidelity statistics across the cluster. Commit the resulting schema.json</code> to your repository so every developer and every AI agent starts the day with a current view.</p>
The snapshot also serves as a lightweight audit trail. If someone adds a column through psql</code> without a migration, the next scheduled dump captures it, and the diff in git shows exactly what changed and when.</p>
What dryrun is not</a>
</h2>
dryrun does not execute arbitrary SQL against your database. It does not manage migrations. It does not provision infrastructure. It is not an ORM, a query builder, or a database admin panel. It's read-only and narrow by design, trustworthy enough that you'd let an AI agent use it unsupervised.</p>
What's next</a>
</h2>
dryrun ships today at v0.5.0. The next releases are focused on:</p>

Shadow EXPLAIN</strong> (v0.6.0): inject production statistics into a local PostgreSQL instance so EXPLAIN</code> produces realistic plans from your laptop, without any production data. Currently explain_query</strong> runs against whatever local database you point it at, but if that database has 10 rows in every table, the planner gives you toy plans that tell you nothing about production behavior.</li>
CI/CD Trust Gate</strong>: a single command that takes a migration file and runs safety analysis, schema diff, lint, and index suggestions in one pass. Designed to block unsafe migrations before they merge.</li>
Improved migration support</strong>: deeper analysis of multi-statement migrations, version-specific advice, and integration with common migration frameworks.</li>
</ul>
Getting started</a>
</h2>
dryrun is MIT licensed and available on GitHub</a>. The tutorial</a> covers installation, offline and online workflows, multi-node setups, and MCP integration. It's part of the boringSQL</a> suite.</p>
Don't let AI touch your production database

Getting started </a> </h2>
dryrun is MIT licensed and available on GitHub</a>. The tutorial</a> covers installation, offline and online workflows, multi-node setups, and MCP integration. It's part of the boringSQL</a> suite.</p>

boringSQL | Supercharge your SQL & PostgreSQL powers - ai

The curious case of Google's AlloyDB
