[Docker Redis] Run Redis with Bitnami, Docker and Docker Compose

Posted on 2021-06-19 Edited on 2023-09-02 In Infrastructure-as-Code-IaC , Container , Docker , Docker Compose , Bitnami Views: Word count in article: 13k Reading time ≈ 12 mins.

Bitnami Redis with Docker and Docker Compose

Bitnami makes it easy to get your favorite open source software up and running on any platform, including your laptop, Kubernetes and all the major clouds. In addition to popular community offerings, Bitnami, now part of VMware, provides IT organizations with an enterprise offering that is secure, compliant, continuously maintained and customizable to your organizational policies.

Redis is an open source (BSD licensed), in-memory data structure store, used as a database, cache, and message broker. Redis provides data structures such as strings, hashes, lists, sets, sorted sets with range queries, bitmaps, hyperloglogs, geospatial indexes, and streams. Redis has built-in replication, Lua scripting, LRU eviction, transactions, and different levels of on-disk persistence, and provides high availability via Redis Sentinel and automatic partitioning with Redis Cluster.

Prerequisites

Docker

Docker is a tool to build safer, share wider, run faster: New updates to our product subscriptions.

See Empowering App Development for Developers | Docker - https://www.docker.com/
to learn more.
Docker Compose

Docker Compose is a tool for defining and running multi-container Docker applications. With Compose, you use a YAML file to configure your application’s services. Then, with a single command, you create and start all the services from your configuration.

See Overview of Docker Compose | Docker Documentation - https://docs.docker.com/compose/ to learn more.

Examples

Docker

Run Redis with Docker.

$ docker run \
    -e ALLOW_EMPTY_PASSWORD=yes \
    -v ${PWD}/runtime/bitnami/redis/data:/bitnami/redis/data \
    bitnami/redis:latest

Docker Compose

Create or edit docker-compose.yml file:

version: '2'

services:
  redis:
    image: docker.io/bitnami/redis:6.2
    environment:
      # ALLOW_EMPTY_PASSWORD is recommended only for development.
      - ALLOW_EMPTY_PASSWORD=yes
      # - REDIS_PASSWORD=password123
      # - REDIS_AOF_ENABLED=no
      - REDIS_DISABLE_COMMANDS=FLUSHDB,FLUSHALL
    ports:
      - '6379:6379'
    volumes:
      - './runtime/bitnami/redis/data:/bitnami/redis/data'

Run Redis with Docker Compose.

1	$ docker-compose up

See bitnami-docker-redis/docker-compose.yml at master · bitnami/bitnami-docker-redis - https://github.com/bitnami/bitnami-docker-redis/blob/master/docker-compose.yml to learn more.

Configuration

Persisting your database

Redis™ provides a different range of persistence options. This contanier uses AOF persistence by default but it is easy to overwrite that configuration in a docker-compose.yaml file with this entry command: /opt/bitnami/scripts/redis/run.sh --appendonly no. Alternatively, you may use the REDIS_AOF_ENABLED env variable as explained in Disabling AOF persistence.

If you remove the container all your data will be lost, and the next time you run the image the database will be reinitialized. To avoid this loss of data, you should mount a volume that will persist even after the container is removed.

For persistence you should mount a directory at the /bitnami path. If the mounted directory is empty, it will be initialized on the first run.

$ docker run \
    -e ALLOW_EMPTY_PASSWORD=yes \
    -v /path/to/redis-persistence:/bitnami/redis/data \
    bitnami/redis:latest

You can also do this by modifying the docker-compose.yml file present in this repository:

services:
  redis:
  ...
    volumes:
      - /path/to/redis-persistence:/bitnami/redis/data
  ...

NOTE: As this is a non-root container, the mounted files and directories must have the proper permissions for the UID 1001.

Disabling Redis™ commands

For security reasons, you may want to disable some commands. You can specify them by using the following environment variable on the first run:

REDIS_DISABLE_COMMANDS: Comma-separated list of Redis™ commands to disable. Defaults to empty.

1	$ docker run --name redis -e REDIS_DISABLE_COMMANDS=FLUSHDB,FLUSHALL,CONFIG bitnami/redis:latest

Alternatively, modify the docker-compose.yml file present in this repository:

services:
  redis:
  ...
    environment:
      - REDIS_DISABLE_COMMANDS=FLUSHDB,FLUSHALL,CONFIG
  ...

As specified in the docker-compose, FLUSHDB and FLUSHALL commands are disabled. Comment out or remove the environment variable if you don’t want to disable any commands:

services:
  redis:
  ...
    environment:
      # - REDIS_DISABLE_COMMANDS=FLUSHDB,FLUSHALL
  ...

Passing extra command-line flags to redis-server startup

Passing extra command-line flags to the redis service command is possible by adding them as arguments to run.sh script:

1	$ docker run --name redis -e ALLOW_EMPTY_PASSWORD=yes bitnami/redis:latest /opt/bitnami/scripts/redis/run.sh --maxmemory 100mb

Alternatively, modify the docker-compose.yml file present in this repository:

services:
  redis:
  ...
    environment:
      - ALLOW_EMPTY_PASSWORD=yes
    command: /opt/bitnami/scripts/redis/run.sh --maxmemory 100mb
  ...

Refer to the Redis™ documentation - https://redis.io/topics/config#passing-arguments-via-the-command-line for the complete list of arguments.

Setting the server password on first run

Passing the REDIS_PASSWORD environment variable when running the image for the first time will set the Redis™ server password to the value of REDIS_PASSWORD (or the content of the file specified in REDIS_PASSWORD_FILE).

1	$ docker run --name redis -e REDIS_PASSWORD=password123 bitnami/redis:latest

Alternatively, modify the docker-compose.yml file present in this repository:

services:
  redis:
  ...
    environment:
      - REDIS_PASSWORD=password123
  ...

NOTE: The at sign (@) is not supported for REDIS_PASSWORD.

Warning The Redis™ database is always configured with remote access enabled. It’s suggested that the REDIS_PASSWORD env variable is always specified to set a password. In case you want to access the database without a password set the environment variable ALLOW_EMPTY_PASSWORD=yes. This is recommended only for development.

Allowing empty passwords

By default the Redis™ image expects all the available passwords to be set. In order to allow empty passwords, it is necessary to set the ALLOW_EMPTY_PASSWORD=yes env variable. This env variable is only recommended for testing or development purposes. We strongly recommend specifying the REDIS_PASSWORD for any other scenario.

1	$ docker run --name redis -e ALLOW_EMPTY_PASSWORD=yes bitnami/redis:latest

Alternatively, modify the docker-compose.yml file present in this repository:

services:
  redis:
  ...
    environment:
      - ALLOW_EMPTY_PASSWORD=yes
  ...

Disabling AOF persistence

Redis™ offers different options when it comes to persistence. By default, this image is set up to use the AOF (Append Only File) approach. Should you need to change this behaviour, setting the REDIS_AOF_ENABLED=no env variable will disable this feature.

1	$ docker run --name redis -e REDIS_AOF_ENABLED=no bitnami/redis:latest

Alternatively, modify the docker-compose.yml file present in this repository:

services:
  redis:
  ...
    environment:
      - REDIS_AOF_ENABLED=no
  ...

Setting up replication

A replication cluster can easily be setup with the Bitnami Redis™ Docker Image using the following environment variables:

REDIS_REPLICATION_MODE: The replication mode. Possible values master/slave. No defaults.
REDIS_REPLICA_IP: The replication announce ip. Defaults to $(get_machine_ip) which return the ip of the container.
REDIS_REPLICA_PORT: The replication announce port. Defaults to REDIS_MASTER_PORT_NUMBER.
REDIS_MASTER_HOST: Hostname/IP of replication master (replica node parameter). No defaults.
REDIS_MASTER_PORT_NUMBER: Server port of the replication master (replica node parameter). Defaults to 6379.
REDIS_MASTER_PASSWORD: Password to authenticate with the master (replica node parameter). No defaults. As an alternative, you can mount a file with the password and set the REDIS_MASTER_PASSWORD_FILE variable.

In a replication cluster you can have one master and zero or more replicas. When replication is enabled the master node is in read-write mode, while the replicas are in read-only mode. For best performance its advisable to limit the reads to the replicas.

Step 1: Create the replication master

The first step is to start the Redis™ master.

$ docker run --name redis-master \
  -e REDIS_REPLICATION_MODE=master \
  -e REDIS_PASSWORD=masterpassword123 \
  bitnami/redis:latest

In the above command the container is configured as the master using the REDIS_REPLICATION_MODE parameter. The REDIS_PASSWORD parameter enables authentication on the Redis™ master.

Step 2: Create the replica node

Next we start a Redis™ replica container.

$ docker run --name redis-replica \
  --link redis-master:master \
  -e REDIS_REPLICATION_MODE=slave \
  -e REDIS_MASTER_HOST=master \
  -e REDIS_MASTER_PORT_NUMBER=6379 \
  -e REDIS_MASTER_PASSWORD=masterpassword123 \
  -e REDIS_PASSWORD=password123 \
  bitnami/redis:latest

In the above command the container is configured as a slave using the REDIS_REPLICATION_MODE parameter. The REDIS_MASTER_HOST, REDIS_MASTER_PORT_NUMBER and REDIS_MASTER_PASSWORD parameters are used connect and authenticate with the Redis™ master. The REDIS_PASSWORD parameter enables authentication on the Redis™ replica.

You now have a two node Redis™ master/replica replication cluster up and running which can be scaled by adding/removing replicas.

If the Redis™ master goes down you can reconfigure a replica to become a master using:

1	$ docker exec redis-replica redis-cli -a password123 SLAVEOF NO ONE

Note: The configuration of the other replicas in the cluster needs to be updated so that they are aware of the new master. In our example, this would involve restarting the other replicas with --link redis-replica:master.

With Docker Compose the master/replica mode can be setup using:

version: '2'

services:
  redis-master:
    image: 'bitnami/redis:latest'
    ports:
      - '6379'
    environment:
      - REDIS_REPLICATION_MODE=master
      - REDIS_PASSWORD=my_master_password
    volumes:
      - '/path/to/redis-persistence:/bitnami'

  redis-replica:
    image: 'bitnami/redis:latest'
    ports:
      - '6379'
    depends_on:
      - redis-master
    environment:
      - REDIS_REPLICATION_MODE=slave
      - REDIS_MASTER_HOST=redis-master
      - REDIS_MASTER_PORT_NUMBER=6379
      - REDIS_MASTER_PASSWORD=my_master_password
      - REDIS_PASSWORD=my_replica_password
```   

Scale the number of replicas using:

```shell
$ docker-compose up --detach --scale redis-master=1 --scale redis-secondary=3

The above command scales up the number of replicas to 3. You can scale down in the same way.

Note: You should not scale up/down the number of master nodes. Always have only one master node running.

Securing Redis™ traffic

Starting with version 6, Redis™ adds the support for SSL/TLS connections. Should you desire to enable this optional feature, you may use the following environment variables to configure the application:

REDIS_TLS_ENABLED: Whether to enable TLS for traffic or not. Defaults to no.
REDIS_TLS_PORT: Port used for TLS secure traffic. Defaults to 6379.
REDIS_TLS_CERT_FILE: File containing the certificate file for the TSL traffic. No defaults.
REDIS_TLS_KEY_FILE: File containing the key for certificate. No defaults.
REDIS_TLS_CA_FILE: File containing the CA of the certificate. No defaults.
REDIS_TLS_DH_PARAMS_FILE: File containing DH params (in order to support DH based ciphers). No defaults.
REDIS_TLS_AUTH_CLIENTS: Whether to require clients to authenticate or not. Defaults to yes.

When enabling TLS, conventional standard traffic is disabled by default. However this new feature is not mutually exclusive, which means it is possible to listen to both TLS and non-TLS connection simultaneously. To enable non-TLS traffic, set REDIS_TLS_PORT to another port different than 0.

Using docker run

$ docker run --name redis \
    -v /path/to/certs:/opt/bitnami/redis/certs \
    -v /path/to/redis-data-persistence:/bitnami/redis/data \
    -e ALLOW_EMPTY_PASSWORD=yes \
    -e REDIS_TLS_ENABLED=yes \
    -e REDIS_TLS_CERT_FILE=/opt/bitnami/redis/certs/redis.crt \
    -e REDIS_TLS_KEY_FILE=/opt/bitnami/redis/certs/redis.key \
    -e REDIS_TLS_CA_FILE=/opt/bitnami/redis/certs/redisCA.crt \
    bitnami/redis:latest

Modifying the docker-compose.yml file present in this repository:

services:
  redis:
  ...
    environment:
      ...
      - REDIS_TLS_ENABLED=yes
      - REDIS_TLS_CERT_FILE=/opt/bitnami/redis/certs/redis.crt
      - REDIS_TLS_KEY_FILE=/opt/bitnami/redis/certs/redis.key
      - REDIS_TLS_CA_FILE=/opt/bitnami/redis/certs/redisCA.crt
    ...
    volumes:
      - /path/to/certs:/opt/bitnami/redis/certs
      - /path/to/redis-persistence:/bitnami/redis/data
  ...

Alternatively, you may also provide with this configuration in your custom configuration file.

Configuration file

The image looks for configurations in /opt/bitnami/redis/mounted-etc/redis.conf. You can overwrite the redis.conf file using your own custom configuration file.

$ docker run --name redis \
    -e ALLOW_EMPTY_PASSWORD=yes \
    -v /path/to/your_redis.conf:/opt/bitnami/redis/mounted-etc/redis.conf \
    -v /path/to/redis-data-persistence:/bitnami/redis/data \
    bitnami/redis:latest

Alternatively, modify the docker-compose.yml file present in this repository:

services:
  redis:
  ...
    volumes:
      - /path/to/your_redis.conf:/opt/bitnami/redis/mounted-etc/redis.conf
      - /path/to/redis-persistence:/bitnami/redis/data
  ...

Refer to the Redis™ configuration - http://redis.io/topics/config manual for the complete list of configuration options.

FAQs

Cant open the append only file - Permission Denied

Non-root container images add an extra layer of security and are generally recommended for production environments. However, because they run as a non-root user, privileged tasks are typically off-limits.

As this is a non-root container, the mounted files and directories must have the proper permissions for the UID 1001.