epicmorg/redis repository overview

⁠epicmorg/redis

Redis built from the redis.io source tarballs (sha256-checked) on Debian 13 trixie, one tag per maintained release line at its newest patch. The entrypoint is a drop-in for bitnami/redis: the same REDIS_* / ALLOW_EMPTY_PASSWORD variables, the same data path /bitnami/redis/data, the same mounted config files and the same uid (1001) - switch the image: line of an existing bitnami compose service and keep its environment and volume.

⁠What's inside

• redis-server, redis-cli, redis-benchmark, redis-check-aof/rdb, redis-sentinel in /usr/local/share/epicmorg/redis/<major.minor>/bin, on PATH; the upstream redis.conf / sentinel.conf in .../etc (8.x: the loadmodule lines commented out, see below);
• TLS built in against the baked OpenSSL 3.5 (LTS, /usr/local/share/epicmorg/openssl/3.5, real RPATH, nothing in ld.so.conf), jemalloc, no systemd;
• /emg-export - redis + the OpenSSL it links as a self-contained tree for COPY --from;
• entrypoint under tini; redis-server runs as redis (uid 1001, group root) when the container starts as root (the data directory is chowned to it), or as whatever --user you give;
• volume /data (native) - /bitnami/redis/data is used instead when it is mounted; port 6379; HEALTHCHECK = redis-cli ping (with REDIS_PASSWORD).

Built with the system compiler (gcc 14) from epicmorg/gcc:14; only src/ is built - the Redis 8 module trees (search, JSON, time series, probabilistic; Rust / CMake toolchains) are not part of the image. Fatal build-time checks: exact version, jemalloc, no unresolved libraries, no RUNPATH, exactly one libssl and it is the baked one, and an entrypoint smoke test (AUTH, AOF, TLS port, disabled command, runs as redis, refuses to start without a password).

⁠Variables

As in bitnami/redis. Every start renders /run/redis/redis.conf (mode 0600) from the base config + these.

Config files, ours or bitnami's paths: base config /etc/redis/redis.conf or /opt/bitnami/redis/mounted-etc/redis.conf (else the shipped one), overrides included last from /etc/redis/overrides.conf or /opt/bitnami/redis/mounted-etc/overrides.conf (REDIS_OVERRIDES_FILE). Not covered: bitnami's sentinel / cluster images.

library/redis style works too: command: redis-server --requirepass ... (arguments after redis-server go to it; --requirepass / --aclfile / --user count as a password). Unlike library/redis, no password at all needs ALLOW_EMPTY_PASSWORD=yes, and its /data volume (uid 999) is handed to uid 1001 on the first start.

⁠Tags

Every tag is pushed to docker.io, quay.io and ghcr.io (epicmorg/redis:<tag> on each) - same digest everywhere.

⁠Usage

services:
  redis:
    image: epicmorg/redis:8           # was: bitnami/redis:latest - environment and volume unchanged
    restart: always
    environment:
      REDIS_PASSWORD_FILE: /run/secrets/redis
      REDIS_DISABLE_COMMANDS: FLUSHDB,FLUSHALL
    volumes:
      - ./redis:/bitnami/redis/data   # or ./redis:/data
    secrets:
      - redis
secrets:
  redis:
    file: ./redis-password.txt

docker exec -it redis redis-cli -a "$(cat redis-password.txt)" info server

⁠Notes

• Licences: Redis 7.4+ is RSALv2 / SSPLv1, 8.0+ also AGPLv3 (redis.io); 6.2 / 7.2 are BSD-3. The image only repackages the unmodified source.
• vm.overcommit_memory = 1 on the host, as Redis logs at start, for reliable background saves.

⁠Links

• Source: EpicMorg/docker⁠ - issues and PRs welcome
• Tags float and are rebuilt weekly; pin by digest for reproducible builds: Tags, pinning and updates⁠
• CHANGELOG⁠ - License: MIT