Alibaba Druid: Druid database connection pool
/druid
Alibaba Druid is worth adopting when a connection pool alone isn't enough and you want visibility into the SQL running through it. Its SQL parser and WallFilter catch injection patterns that HikariCP simply doesn't look at, and StatFilter's Web page shows pool and query stats without wiring in extra tooling. The catch: the main README defaults to Chinese, and druid-admin is one more component to secure.
What is Alibaba Druid
Alibaba Druid is a Java database connection pool built by Alibaba's DataWorks team that folds JDBC pooling, an SQL parser, a SQL firewall, and monitoring into one library. Rather than just handing out and reclaiming connections the way HikariCP or c3p0 do, Druid parses every statement into an AST first, so it can format, rewrite, and inspect SQL too. It ships as a plain DruidDataSource or as a Spring Boot starter for versions 2.x, 3.x, and 4.x.
Key features
- ✓DruidDataSource pools JDBC connections with physical connection warmup, PSCache, and KeepAlive built in.
- ✓The SQL parser covers 30 database dialects and builds a full AST for each statement.
- ✓WallFilter blocks SQL injection and dangerous operations by analyzing that AST, not by matching text patterns.
- ✓StatFilter tracks SQL execution and pool stats in real time and exposes them on a Web monitoring page.
- ✓A pluggable Filter-Chain lets you add logging, encryption, or custom stats without touching the pool itself.
- ✓Spring Boot starters exist for 2.x, 3.x, and 4.x, each auto-configuring DruidDataSource from application.yml.
- ✓HighAvailableDataSource load-balances across multiple datasources with health checks and failover.
Adding Druid to your Maven project
Add Druid as a plain Maven dependency: groupId com.alibaba, artifactId druid, version 1.2.24. For Spring Boot, swap in the version-matched starter instead — druid-spring-boot-starter for Spring Boot 2.x, druid-spring-boot-3-starter for 3.x, or druid-spring-boot-4-starter for 4.x — using the same 1.2.24 version. Building from source instead needs Java 8+ JDK and Apache Maven 3.6+: clone the repo and run mvn clean install. Gradle setup isn't shown in the README, so translate the Maven coordinates yourself if that's your build tool.
Configuring DruidDataSource directly and with Spring Boot
Two ways to wire up DruidDataSource. Directly: instantiate DruidDataSource, call setUrl, setUsername, setPassword, setInitialSize, setMaxActive, and setMinIdle, then call init() before pulling connections with getConnection(). With Spring Boot: add the matching starter and configure spring.datasource.druid in application.yml — initial-size, max-active, min-idle, and max-wait control the pool, while filter.stat.enabled (with log-slow-sql and slow-sql-millis) turns on monitoring and filter.wall.enabled turns on the SQL firewall. Separately, SQLUtils.parseStatements() and SQLUtils.format() work on raw SQL strings without touching a pool at all — useful if you only want the parser.
Strengths
- ✓One dependency covers pooling, SQL parsing, firewalling, and monitoring instead of four separate libraries.
- ✓WallFilter reasons about a parsed AST, not regex, before flagging a query as dangerous.
- ✓Spring Boot starters track 2.x, 3.x, and 4.x, so a Spring Boot upgrade doesn't strand the integration.
- ✓SQLUtils is usable on its own for SQL formatting and analysis in tooling that never touches the pool.
Known limitations and maintenance concerns
- △The main README defaults to Chinese; English content lives in a separate README_EN.md and a separate wiki FAQ page, so non-Chinese teams have to actively switch files.
- △The monitoring Web UI is another thing to lock down — WallFilter guards SQL, not who can view your pool and query stats.
- △Gradle isn't documented.
How Druid compares to HikariCP, c3p0, and DBCP2
When Druid is the right choice
Druid fits a Java team already running MySQL, PostgreSQL, Oracle, or one of Druid's other 30 supported dialects, that wants pool monitoring and basic SQL-injection defense without adding a separate APM agent or firewall. It also fits anyone who needs to parse or rewrite SQL programmatically — SQLUtils works independent of the pool. It's a poor fit if you just want the fastest, simplest pool and don't care about SQL-level visibility; that's HikariCP's job, not Druid's.
Frequently asked questions
Alibaba Druid's SQL parser covers 30 database dialects, including mainstream relational databases like MySQL, PostgreSQL, Oracle, and SQL Server, analytical engines like ClickHouse and StarRocks, and compute engines like Hive, Spark, and Presto — each dialect gets its own lexer, parser, AST, and visitor implementation.
Alibaba Druid ships dedicated Spring Boot starters: druid-spring-boot-starter for Spring Boot 2.x, druid-spring-boot-3-starter for Spring Boot 3.x, and druid-spring-boot-4-starter for Spring Boot 4.x, each providing auto-configuration out of the box so you don't wire up DruidDataSource as a bean by hand.
The Alibaba Druid README doesn't use the phrase production-ready, but it describes Druid as built by Alibaba's DataWorks team specifically for monitoring database connections, and it ships under the Apache-2.0 license with starters for Spring Boot 2.x through 4.x.
Druid's WallFilter parses every SQL statement into an AST rather than pattern-matching raw text, then checks that AST against rules for injection patterns and dangerous operations before the query reaches the database, blocking matches instead of just logging them.
Alibaba Druid's README doesn't publish benchmark numbers against HikariCP, so a direct performance comparison isn't clearly documented. The practical difference is scope: HikariCP is a minimal pool, while Druid adds SQL parsing, firewalling, and monitoring on top of pooling.
Enable Druid's monitoring Web UI by turning on StatFilter — in Spring Boot, set filter.stat.enabled to true (optionally with log-slow-sql and a slow-sql-millis threshold) in application.yml; StatFilter then collects SQL execution and pool stats for the built-in monitoring page.
The problem it solves
Alibaba Druid was built by Alibaba's DataWorks team to answer a question plain JDBC pools like DBCP2 or c3p0 don't: what is actually happening inside the pool and in the SQL passing through it? A generic pool hands out and reclaims connections but won't tell you which queries are slow, won't parse SQL to check what a query does, and won't stop an injected statement before it reaches the database. Druid folds pooling, an SQL parser, WallFilter, and StatFilter into one dependency instead of assembling separate tools for each concern.
Best use cases
- •Replacing a plain JDBC pool with one that also blocks SQL injection via WallFilter, instead of bolting on a separate firewall.
- •Diagnosing slow queries with StatFilter's log-slow-sql setting and the built-in monitoring page rather than adding an APM agent.
- •Parsing, formatting, or rewriting SQL across multiple dialects in tooling, using SQLUtils independent of the pool.
- •Running several datasources behind one pool with HighAvailableDataSource for load balancing and failover.
Still deciding about druid?
One click hands the question to an AI along with this page — see what it says about druid.