skycloak/locke repository overview

⁠Locke

A drop-in Keycloak distribution that can run its caches on Redis instead of embedded Infinispan. Same admin console, same database, same SPIs. You pick the cache backend at boot with one environment variable. When you don't pick Redis, Locke is the Keycloak it was built from, unchanged.

• Source & docs: https://github.com/sky-cloak/locke⁠
• Why it exists: https://github.com/sky-cloak/locke/blob/main/WHY.md⁠
• Benchmark report: https://github.com/sky-cloak/locke/blob/main/benchmark/k8s-ovh/REPORT.md⁠
• License: Apache 2.0 (inherited from upstream Keycloak)

⁠Quick start

Both backends ship in the same image. Choose with one variable.

# Default: embedded Infinispan, identical to upstream Keycloak
docker run --rm -p 8080:8080 \
  -e KC_BOOTSTRAP_ADMIN_USERNAME=admin -e KC_BOOTSTRAP_ADMIN_PASSWORD=admin \
  skycloak/locke:26.6.2-2 start-dev

# Redis backend: point it at any Redis / Valkey / wire-compatible store
docker run --rm -p 8080:8080 \
  -e KC_CACHE=redis -e KC_CACHE_REDIS_URL=redis://my-redis:6379 \
  -e KC_BOOTSTRAP_ADMIN_USERNAME=admin -e KC_BOOTSTRAP_ADMIN_PASSWORD=admin \
  skycloak/locke:26.6.2-2 start-dev

⁠Configuration

Every other Keycloak option works exactly as upstream.

⁠Tags & versioning

Locke uses composite versioning: <keycloak-version>-<locke-build>. 26.6.2-2 means "Keycloak 26.6.2, Locke build 2." The latest build on each line carries the current Redis client fixes.

latest tracks the current line. Images are multi-arch: linux/amd64 and linux/arm64.

Also published to ghcr.io/sky-cloak/locke and quay.io/skycloak/locke.

⁠Run managed

Don't want to operate this yourself? Skycloak⁠ runs managed Keycloak (and Locke) for you.