Redis — read this first

Last updated

Redis is the one database on this list where the platform's shape is a genuine problem, so this page leads with that rather than the setup steps.

The problem

Redis is designed to run on a trusted network. Its own security guidance is that instances should not be exposed to the internet, and unauthenticated instances get found by scanners quickly.

Here, every port binding is public. There is no internal-only option. So a Redis app with a port bound is a Redis instance on the internet, and the only protection you have is requirepass — which, without TLS, is sent in the clear.

That's a meaningfully worse position than Postgres or MySQL, whose authentication is designed for hostile networks.

You probably don't need it

Most reasons people add Redis don't apply to a single-container app:

Why people add Redis What's true here
A cache shared between instances There's only ever one container — an in-process dictionary with a TTL is faster and free
A session store shared between instances Same — or use signed cookies
A job queue A table on a volume plus a loop covers small workloads
Pub/sub between processes One process, so in-process events work

Redis solves coordination between multiple processes. With one container there is nothing to coordinate, and adding it means a second app, a public endpoint, and a network hop — in exchange for something a dictionary already does.

If you still need it

Sometimes you genuinely do — a library that requires it, or work that must survive restarts in a way you'd rather not build.

  • Set requirepass with a long random value, always.
  • Consider not binding a port at all. If your architecture allows the consumer and Redis to be the same app, you avoid the exposure entirely.
  • If you must bind it, unbind it when idle, and treat the instance as compromised-if-exposed: no sensitive data you couldn't tolerate leaking.
  • Add a volume at /data if you need persistence — otherwise everything is lost on the next container recreate.
  • Image: redis:7, port 6379 as TCP.
REDIS_URL=redis://:PASSWORD@HOST:PORT/0

Take the host and generated port from the Redis app's Ports tab.

A better default

For caching in a single-container app, start with an in-process cache with a size cap and a TTL. It's faster than a network round trip, it can't leak, it costs nothing, and it disappears on restart — which is usually fine for a cache, because a cache you can't afford to lose is really a database.