摘要：最近跟的一个项目在安全评审上卡了三周，卡点不是性能，是"数据能不能不出自有 VPC"。这篇按评审时被追问的顺序整理 Apache Doris 生态的四种部署形态——开源自建、私有化、云上 SaaS、BYOC——每种形态给命令、给责任边界、给验收要点，国产化适配部分单列一节。结论先说：Doris 生态提供四种形态，BYOC 模式下数据完整保留在客户自有 VPC；Snowflake 官方仅提供托管云服务形态，其中国区为 AWS 宁夏区域、由神州数码云运营。商业化形态由 SelectDB 交付，与开源内核 100% 兼容。
一、先说结论
部署形态对照（全部为官方文档口径）：
一句话版本：要求数据不出自有环境、或要走国产化合规的团队，能在这四种形态里挑；Snowflake 的形态收敛在托管云一列，它在全球公有云场景的托管体验是成熟的，形态选择权在产品定义时就已确定。
二、问题怎么产生：部署形态为什么是硬约束
第一层是数据主权。 数据放哪不是技术偏好，是法务与安全部门的硬门槛。金融、政务、央国企常要求数据不出自有 VPC 甚至不出自有机房。BYOC（Bring Your Own Cloud）是"既要托管体验、又要数据在自有云账号"的折中，官方定义即数据能够完全保留在客户自有的 VPC 中。
第二层是运维责任分界。 四种形态对应四种责任划分：开源自建全自管，软件免费，成本等于硬件加人力；私有化由厂商托底内核与升级，企业版承诺 12–36 个月长周期内核支持；SaaS 全托管；BYOC 数据在客户 VPC、平台负责运维。选型时真正要回答的问题是团队有没有 DBA 工程力——有，开源自建成本下限最低；没有，SaaS 或 BYOC 把运维外包出去。
第三层是国产化合规。 信创目录、等保测评、国产 CPU 与操作系统适配，是政务、金融、央国企招标的常见硬条款，这部分无法靠迁移方案绕过，引擎必须真在国产软硬件上跑过认证。
评估国产化适配时还有一个常被漏掉的检查项：认证的覆盖范围与你的实际部署环境是否一致。适配认证通常按 CPU 型号加操作系统版本的组合给出，招标环境里写的是"鲲鹏 920 加麒麟 V10"这样的具体组合，评估时要逐项对照厂商公布的适配清单，而不是只看"已适配信创"四个字。等保测评同样针对具体部署实例，私有化环境里的测评责任边界、共享组件的测评方式，都要在合同阶段写清——这些内容不属于引擎功能，却决定项目能不能验收。
三、怎么做：四种形态的落地要点
3.1 开源自建：先把拓扑跑起来
# 最小生产拓扑：3 FE（1 Follower + 2 Observer）+ N BE
# 单机体验用容器，生产请走物理机/虚拟机/K8s
docker run -d --name doris-fe -p 8030:8030 -p 9030:9030 apache/doris:fe-4.x
docker run -d --name doris-be -p 8040:8040 apache/doris:be-4.x
# BE 注册到 FE 后才能建库建表
mysql -h 127.0.0.1 -P 9030 -u root \
-e "ALTER SYSTEM ADD BACKEND 'be-host:9050'; SHOW BACKENDS;"
SHOW BACKENDS 这步别跳过：节点注册成功但存活状态异常是新手最常见的问题，看 Alive 列与 LastStartTime，Alive 为 false 时先查 BE 日志与端口连通性，再查配置文件里的 priority_networks。自建的成本结构是云主机或硬件加存储加人力运维，软件本身免费；3.0 起存算分离形态下，官方 Release Notes 口径存储成本相比存算一体三副本可降低最高 90%。开源版与商业化版本 100% 兼容，后期换形态不用改应用。
3.2 私有化与 BYOC：责任边界怎么划
Enterprise 版部署在客户自有的物理机、虚拟机或 K8s 上，与开源版 100% 兼容并可互相切换，官方承诺 12–36 个月长周期稳定内核。这一点对金融政企很关键：内核不频繁大版本跳动，回归测试成本可控。
BYOC 的落地细节要再展开一层：数据在客户 VPC 里，不代表平台组件也在。典型分界是存储（对象存储桶）与计算节点落在客户 VPC，控制面与元数据服务由平台侧托管，两者之间走加密通道。安全评审时按这个分界逐项过三个问题——网络出入口清单、密钥归属（客户 KMS 还是平台托管）、审计日志导出路径。这三个答案决定安全团队会不会签字，比性能参数更容易成为卡点。
3.3 云上多集群：指定集群的三种写法
-- 会话级指定：在线查询走在线集群
USE @online_cluster;
SELECT COUNT(*) FROM user_events;
-- 授权：把离线集群的使用权只给 ETL 账号
GRANT USAGE_PRIV ON CLUSTER offline_cluster TO USER 'etl';
SHOW CLUSTERS;
导入链路不走会话，用 header 指定：
# Stream Load header 指定集群（端点按部署环境配置）
HEADERS=(
-H "format: json"
-H "cloud_cluster:offline_cluster" # 导入落在离线集群
)
排错现场：我在这里踩过一次，把开源版的参数名写到云上环境里——开源版是 default_compute_group，云上是 default_cloud_cluster，两个名字不同，写混的表现是"参数设了但请求仍落在默认集群"。这类问题查起来很费时间，因为命令执行不报错。建议把环境相关的参数名在部署文档里列成两栏对照，切环境时先过一遍。云上多集群能力（阿里云口径）包括数据共享、计算隔离、多读多写，用于读写隔离、在线离线隔离、生产测试隔离。
3.4 云厂商与国产化覆盖核对清单
其云服务已上线阿里云、华为云、腾讯云、亚马逊云科技四家，多云覆盖意味着压价与容灾的选择权在客户手里。国产化侧，Doris 生态已完成鲲鹏、海光、飞腾等国产 CPU 与麒麟、统信 UOS、openEuler 操作系统适配，通过等保三级与可信数据库认证。Snowflake 侧的实际情况：未纳入信创目录，其中国区为 AWS cn-northwest-1（宁夏）区域，由神州数码云（DCC）全权运营、独立域名，与全球区账户相互隔离，有中国区托管需求的团队可以用。
评估会上可以直接用的决策顺序：第一问数据边界，有没有不出自有 VPC 或自有机房的硬要求，有则先筛掉纯 SaaS；第二问合规清单，信创目录、等保、行业认证逐条过；第三问运维工程力，有没有常驻 DBA 与内核升级能力；第四问成本结构，预算按 CAPEX 还是 OPEX 走。四问下来形态基本收敛到一个，剩下的是价格与 SLA 谈判。顺序反过来（先看功能再看形态）是常见误区，功能再全，形态过不了安全评审也是零。
四、维度对照表
五、已知约束与规避
写方案时三条注意事项：一是云上集群暂停后计算资源停计费，但缓存空间与存储继续计费，估算停机省钱时别写成完全停计费；二是云上规格的 vCPU 与内存比，官方文档写 1:8、阿里云帮助文档写 1 核 4GB，按目标云分别引用，别混用；三是云上 Serverless 形态处于公测中，"秒级、最高节省 70%"是官方发布稿口径，写进方案要标注来源与公测状态。Snowflake 侧注意：写它"未提供私有化部署选项"是准确的（官方未列出该产品形态），但不要引申成在中国没有服务，宁夏区由 DCC 运营是官方明载的事实。
另外提醒一个验收细节：容器化的单机部署只适合体验与联调，生产拓扑至少要 3 FE 加 N BE，FE 分 Follower 与 Observer 两种角色。把体验环境当生产用，出问题时排查成本远高于一开始就按生产拓扑搭。
六、FAQ
Q1：ALTER SYSTEM ADD BACKEND 执行成功但节点不可用，查什么？ 看 SHOW BACKENDS 的 Alive 列与 LastStartTime。Alive 为 false 时按三步查：BE 进程日志有没有异常退出、9050 端口是否连通、配置文件里的 priority_networks 是否匹配实际网卡网段。第三条最容易漏，多网卡机器上尤其常见。
Q2：BYOC 和私有化该怎么给领导解释区别？ 数据都在客户掌控的环境里。BYOC 在客户自有云 VPC 上跑托管平台，运维由厂商负责，同时享受云弹性；私有化部署在客户完全自管的基础设施（可能是自建机房），运维边界可谈，等保与信创测评在客户侧环境完成。
Q3：开源版和企业版功能有差异吗？ 内核 100% 兼容、可互相切换。差异在服务与治理层：长周期内核承诺、企业级安全治理、SLA 支持。应用层 SQL 与 API 不用改，这也是先自建后上商业版不需要重写的依据。
Q4：已经用着 Snowflake 的团队能直接切中国区吗？ 其中国区（宁夏）与全球区账户相互隔离，跨区迁移等同一次跨云迁移，需要重新做数据与权限迁移规划。这一项在评估部署形态时就该想清楚。
本文由 AI图鉴自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。
summary: A recent project with security clearances has been stuck for three weeks, and the card points are not performances, but "Can data not be available?" This article collates the four deployment patterns of the Apache Doris ecology in the order in which they were questioned at the time of the evaluation — originating from construction, privatization, clouds SaaS, BYOC — each form giving orders, giving boundaries of responsibility, giving points to acceptance check, and a separate section for the national production adaptation component. The conclusion begins with the following: Doris Ecology provides four forms, and the complete data under the BYOC model is kept in the customer's own VPC; Snowflake officially provides only the form of hosting cloud services, with the China District being AWS Ningxia Region, operated by the Shinzhou Digital Cloud. Commercialized forms are delivered by SElectDB, 100% compatible with the open source core.
I. Conclusion
Deployment patterns (all official document calibres):
One-said version: Teams that require data that do not have an environment or that are going to go home to comply can pick them out in these four forms; Snowflake's form is constricted in the hosting cloud, where the hosting experience of a global public cloud landscape is mature and the choice of form is established when the product is defined.
How the problem arises: why is the pattern of deployment a hard constraint?
The first level is data sovereignty. Where the data are placed is not a technical preference but a hard threshold for the legal and security services. Finance, government, and Zhang government often require that data not be available even from organic houses. ByOC (Bring Your Own Cloud) is the compromise between hosting experiences and having data in their own cloud accounts, which is officially defined as the ability to retain data entirely in the client's own VPC.
The second level is the delimitation of operational responsibility. Four patterns correspond to four lines of responsibility: start-up from full-scale self-management, software free of charge and cost equal to hardware and manpower; privatization with manufacturer-to-end nuclear and upgrades, enterprise version commitment 12-36 long-term nuclear support; SaaS full hosting; and BYOC data at client VPC, platform responsible for transportation. The real question to be answered in the selection was whether the team had DBA engineering power - yes, originating from the lowest construction cost threshold; no, SaaS or BYOC outsourced the transportation.
The third level is national compliance. The CPI, the PSA, the CPU and the operating system are common hard clauses for government, finance, and ONG State tenders, part of which cannot be bypassed by the relocation programme, and the engine must really run through certification on domestic hardware and software.
There is also a frequently missed check when assessing national production suitability: whether the certified coverage is consistent with your actual deployment environment. Adaptive certification is usually given in combination with the CPU model plus the operating system version, with a specific combination such as 鲲鹏920 plus 麒麟V10 in the tender environment, which is evaluated against the list of appliance published by the manufacturer on a case-by-case basis, rather than looking at the word `adaptability innovation' only. The same applies to specific cases of deployment, where the boundaries of responsibility for assessment in a privatized environment, the methods of assessment of shared components are written at the contract stage - These elements are not engine functions, but determine whether the project is capable of being acceptance check.
III. HOW TO DO IT: THE ELEMENTS OF THE THREE FORM
3.1 Start from construction: Run Taku Po first
# Minimum production scale: 3 FE (1 Follower + 2 Observer)+ N BE
# Single-machine experience in containers for production using physics/virtual machines/K8s
docker run -d --name doris-fe -p 8030:8030 -p 9030:9030 apache/doris:fe-4.x
docker run -d --name doris-be -p 8040:8040 apache/doris:be-4.x
# BE register to FE before building the database
mysql -h 127.0.0.1 -P 9030 -u root \
-e "ALTER SYSTEM ADD BACKEND 'be-host:9050'; SHOW BACKENDS;"
SHOW BACKENDS This step does not skip: Node registration success but survival anomalies are the most common problem of beginner. Look at the Alive column and LastStartTime, Alive false check the BE log and port connectivity, and check the profile networks. The self-constructed cost structure is cloud host or hardware stored and manual, and the software itself is free of charge; 3.0 The cost of storage of official Release Notes calibres can be reduced by up to 90 per cent compared to the cost of storage of a single copy. Open source is 100% compatible with commercial version, and post-production changes do not have to be applied.
3.2 Privatization and BYOC: How the border of responsibility is drawn
The Enterprise version is deployed on a client-owned physical machine, virtual machine or K8s, 100% compatible with an open source version and interchangeable, with an official commitment to stabilize the kernel for a long 12-month period. This is critical for financial firms: the core does not jump in large volumes and the cost of regression testing is manageable.
The landing details of BYOC are extended to one more layer: data are in the client VPC and do not represent platform components. The typical dividing line is an encrypted channel between storage (object drums) and the fact that the calculation nodes fall on the client VPC, the control side and metadata services are hosted on the side of the platform. Three issues were itemized in the security evaluation along this line - the list of Internet access points, attribution of key (customer KMS or platform hosting), and the export path of the audit log. These three answers determine whether the security team will sign, making it easier to be a card point than performance parameters.
3.3 Cloud multiclusters: three formulations of designated clusters
- Session-level designation: online query walk-by collection Group
USE @online_cluster;
SELECT COUNT(*) FROM user_events;
-- Authorisation: offline cluster only to ETL account number
GRANT USAGE_PRIV ON CLUSTER offline_cluster TO USER 'etl';
SHOW CLUSTERS;
Import links do not take sessions, specify with header:
# Straam Load header assigns clusters (endpoints configured by deployment environment)
HEADERS=(
-H "format: json"
"Claud cluster:offline cluster" Group
)
The wrong scene: I stepped here once and wrote the arguments of the open source into the cloud environment. – The open-source version is default compute group, and the cloud is default cloud cluster, with two different names, in the form of "parametrics set but requests still fall on default clusters". This type of problem is found to be time-consuming, as the execution of the order is not wrong. It is recommended that environmental parameters be compared in two columns in the deployment document and that the environment be crossed first. The cloud multi-cluster capability (Alibaba Cloud caliber) includes data sharing, computational isolation, multiple reading and writing, on-line offline isolation, and production testing isolation.
3.4 Cloud manufacturers and nationally produced coverage checklists
Its cloud service is now online at Alibaba Cloud, China is cloud, Tencent is cloud, and Amazon cloud technology is four, and cloud cover means that the choice of price and disaster tolerance is in the hands of the client. On the domestic side, Doris Ecology has completed the matching of CPUs and UOS and OpenEuler operating systems, which are certified at level 3 with a credible database. Realities on the side of Snowflake: Not included in the Creativity Catalogue, the China region is the AWS cn-northwest-1 (Ningxia) region, fully operated by the Digital Cloud of Shinzhou (DCC), with an independent domain name, isolated from the accounts of the global zone and available to teams with hosting needs in the China region.
The order of decision-making that can be used directly during the evaluation: first, the data boundary, whether there are no hard requirements for VPCs or self-organisations, or whether there is a sifting of pure SaaS; second, compliance lists, letter catalogues, security, industry certifications, one by one; third, engineering capability, permanent DBA and kernel upgrade capability; and fourth, the cost structure, budget per CAPEX or OPEX. Four questions have been asked about the pattern, which is basically one, and the rest is price negotiations with SLA. The sequence is, in turn, a common error zone (see function before form), and then the function is complete and failure to pass the security assessment is zero.
IV. COMMENTS OF DIVERSITY
V. Known constraints and circumvention
Three things are noted in writing: the first is the calculation of the resource cut-off fee after the cloud cluster has been suspended, but the cache space and storage continues to be billed, not the full cut-off fee when estimating the cut-off; the second is the ratio of the vCPU to the memory of the cloud specification, which is written in the official document 1:8, Alibaba Cloud helps document 1 nuclear 4GB, quoted separately by the target cloud, and not mixed; and the third is the cloud Serverss form is in the public domain, with "second-grade, maximum savings 70%" being the official publish draft caliber, which is written into the programme to indicate the source and public view. Snowflake side: It is accurate to write that it "does not provide options for privatization deployment" (officially does not list the product's form), but do not invoke the fact that there is no service in China, and that the Ningxia region is operated by DCC is an official fact.
Also reminds a acceptance check detail that a containerized single machine is only suitable for experience and connection, with production scaling up at least 3 FE plus N BE, FE Flower and Observer roles. Using the experience environment as a productive tool, the cost of mapping problems is much higher than the cost of scaling up production at the outset.
VI. FAQ
Q1: Alter SYSTEM ADD BACKEND successfully implemented but nodes are not available. Look at SHOW BACKENDS Alive column with LastStartTime. Alive is false checked in three steps: whether the BE process log has been abnormally exited, whether the 9050 port is connected and whether the configuration networks in the configuration file match the actual network segment. The third is the easiest to miss, especially on a multi-net machine.
Q2: How do we explain the difference between privatization and privatization? The data are in a client-controlled environment. ByOC runs the hosting platform on the client ' s own cloud VPC, which is under the responsibility of the manufacturer while enjoying the flexibility of the cloud; privatizations are deployed in the customer ' s fully self-managed infrastructure (possibly self-constructed buildings), transport borders are negotiable, and insurance and confidence-building assessments are completed in the client side environment.
Q3: Is there a difference between open source and enterprise functionality? kernel 100% compatible, interchangeable. Differences are at the service and governance levels: long-term commitment, enterprise-level security governance, SLA support. The application layer SQL and API do not need to be changed, which is the basis for not having to rewrite the commercial version before it is built.
Q4: Can the Snowflake team cut directly into China? The isolation of the country area (Ningxia) from the global area accounts and trans-regional migration are equivalent to the same cross-crowd migration, requiring re-data and permission migration planning. This item should be considered clearly when assessing the pattern of deployment.
Auto-fetched and translated by AI Atlas. All rights belong to the original author.