Harden Redis entrypoint password handling and maxmemory policy checks #1

Merged

MHE merged 1 commit from review-redis-image-defaults into main 2026-11-03 11:32:36 +01:00

Conversation 0 Commits 1 Files changed 2 +28 -6

MHE commented 2026-11-03 11:25:52 +01:00

Owner

Copy link

What changed

entrypoint.redis.sh

• The password secret is now copied to a mode-0600 work file (/tmp/redis.password) before validation. A single trailing newline is stripped from the copy, so the original secret file is never modified.
• The work file is removed on exit via a trap and again just before exec redis-server.
• Byte-count and line-break checks now strip whitespace from wc output so they compare cleanly on all platforms.
• REDIS_MAXMEMORY_POLICY is now refused when REDIS_MAXMEMORY is empty. Previously a policy could be set on a generic profile that has no maxmemory, which silently did nothing.

README.md

• Documents that one trailing newline in the password file is ignored, and that any other line break is still refused.
• Documents that REDIS_MAXMEMORY_POLICY requires REDIS_MAXMEMORY.
• Adds container sizing guidance per profile: generic needs the volume and a 64 MiB /tmp tmpfs; cache stores data on a tmpfs of at least 512 MiB and omits /data; queue keeps the volume and needs at least 1536 MiB container memory with the default 768mb.

Why

• Editors and echo commonly append a trailing newline to secret files; rejecting it caused confusing startup failures.
• A policy without a maxmemory limit was a silent misconfiguration. Failing fast makes it visible.
• Keeping a validated copy in a private work file and deleting it on exit keeps the password out of the original mount path logic and out of leftover temp files.

## What changed ### entrypoint.redis.sh - The password secret is now copied to a mode-0600 work file (`/tmp/redis.password`) before validation. A single trailing newline is stripped from the copy, so the original secret file is never modified. - The work file is removed on exit via a trap and again just before `exec redis-server`. - Byte-count and line-break checks now strip whitespace from `wc` output so they compare cleanly on all platforms. - `REDIS_MAXMEMORY_POLICY` is now refused when `REDIS_MAXMEMORY` is empty. Previously a policy could be set on a `generic` profile that has no maxmemory, which silently did nothing. ### README.md - Documents that one trailing newline in the password file is ignored, and that any other line break is still refused. - Documents that `REDIS_MAXMEMORY_POLICY` requires `REDIS_MAXMEMORY`. - Adds container sizing guidance per profile: `generic` needs the volume and a 64 MiB `/tmp` tmpfs; `cache` stores data on a tmpfs of at least 512 MiB and omits `/data`; `queue` keeps the volume and needs at least 1536 MiB container memory with the default `768mb`. ## Why - Editors and `echo` commonly append a trailing newline to secret files; rejecting it caused confusing startup failures. - A policy without a maxmemory limit was a silent misconfiguration. Failing fast makes it visible. - Keeping a validated copy in a private work file and deleting it on exit keeps the password out of the original mount path logic and out of leftover temp files.

MHE added 1 commit 2026-11-03 11:25:52 +01:00

Ignore trailing newline in Redis password secret 6ac3f3cd35

MHE merged commit e0c9bc5b87 into main 2026-11-03 11:32:36 +01:00

MHE referenced this pull request from a commit 2026-11-03 11:32:38 +01:00

Harden Redis entrypoint password handling and maxmemory policy checks (#1)

MHE deleted branch review-redis-image-defaults 2026-11-03 11:32:43 +01:00

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

openso/redis!1

No description provided.