redis

One Redis process for a generic instance, an ephemeral cache, or a durable queue. The deployment stack stays in docker-templates. This repository is the image only.

The process runs as the vendor redis user, UID 999 and GID 999. Compose sets a read-only root filesystem. The entrypoint writes its config on a /tmp tmpfs.

Image

git.openso.de/openso/redis:main

docker-templates uses git.openso.de/openso/redis with no tag. Docker resolves that reference to :latest. :latest is the same build as :main.

Runtime

1. The entrypoint reads REDIS_PASSWORD_FILE. It ignores one trailing newline. It refuses CHANGE_ME, any other line break, control characters, and a length outside 12 to 4096.
2. It writes a mode-0600 /tmp/redis.conf from REDIS_PROFILE and the override variables. The password is a Redis hex escape in that file. It is not placed on the process command line. DEBUG is renamed away.
3. It execs redis-server with that file. The command must be exactly redis-server.

/data is the persistent directory for generic and queue. cache keeps its data on /tmp and does not use the volume.

Environment

These values are runtime switches. They do not install packages and they do not select another image.

Variable	Default	Purpose
REDIS_PASSWORD_FILE	/run/secrets/REDIS_PASSWORD	Docker secret file that holds the password.
REDIS_PROFILE	generic	generic, cache, or queue.
REDIS_MAXMEMORY	empty	Empty keeps the profile default. cache defaults to 384mb. queue defaults to 768mb.
REDIS_MAXMEMORY_POLICY	empty	Empty keeps the profile default. A set value requires REDIS_MAXMEMORY. generic has no maxmemory until that variable is set, so a policy alone is refused.
REDIS_APPENDONLY	empty	yes or no. Empty keeps the profile default.
REDIS_SAVE	empty	off or a threshold such as 60 1. Empty keeps the profile default.
REDIS_APPENDFSYNC	everysec	Used when AOF is enabled. always, everysec, or no.
REDIS_DIR	empty	/tmp or /data. Empty keeps the profile default.

generic saves an RDB snapshot 60 1 under /data. cache does not persist, uses allkeys-lru, and stores data under /tmp. queue uses AOF everysec with an RDB preamble, noeviction, and /data.

Cache maxmemory must stay at or below 75% of the container memory limit. Queue maxmemory must stay at or below 50%, because an AOF rewrite forks. Generic maxmemory, when set, must stay at or below 75%.

Compose

services:
  redis:
    image: git.openso.de/openso/redis
    user: "999:999"
    read_only: true
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    tmpfs:
      - /tmp:rw,noexec,nosuid,nodev,size=64m,uid=999,gid=999,mode=1770
    volumes:
      - redis:/data:rw
    secrets:
      - REDIS_PASSWORD
    environment:
      REDIS_PROFILE: generic
      REDIS_PASSWORD_FILE: /run/secrets/REDIS_PASSWORD
    healthcheck:
      test: ['CMD-SHELL', 'REDISCLI_AUTH="$$(cat "$$REDIS_PASSWORD_FILE")" redis-cli --no-auth-warning ping | grep -qx PONG']

secrets:
  REDIS_PASSWORD:
    file: ./secrets/REDIS_PASSWORD

volumes:
  redis:

generic uses the volume and a 64 MiB /tmp tmpfs for the config file. cache stores data on /tmp, so that tmpfs is at least 512 MiB and the /data volume is omitted. Its container memory limit is at least 512 MiB. queue keeps the volume. With the default 768mb, its container memory limit is at least 1536 MiB.

A second instance is another service in the app Compose file. It uses this same image, its own secret, and its own volume.

Contents

Pin	Value
Base image	redis:8.10.3-trixie@sha256:de1068af6f552240dfab67bcc9bfef99bfc60f776bb4580ef077ea4c8c97e848

A version bump changes that pin.

Build

A push to main publishes git.openso.de/openso/redis:main and :latest. A tag v* publishes that tag and :latest. The first commit on main is that push.