Apache Kvrocks

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet and subnet in the target region.

Standard_B2s (2 vCPU / 4 GiB RAM) is a good starting point. In the NSG, allow inbound 22/tcp from your management network. No inbound application ports are needed because you reach Kvrocks over an SSH tunnel.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Apache Kvrocks by SecureAnyCloud, and select Create.

On Basics, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) only. Then select Review + create, and then Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:apache-kvrocks-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name kvrocks \
  --image sac1647283583153:apache-kvrocks-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm Kvrocks is installed and running

kvrocks --version systemctl is-active kvrocks

You should see Kvrocks 2.16.0 and active:

kvrocks version 2.16.0 active

Step 5 - Retrieve your per-VM password

Each VM generates its own unique Kvrocks password on first boot and writes it to a root-only credentials file:

sudo cat /root/kvrocks-credentials.txt

The file contains KVROCKS_PASSWORD, the connection string and the SSH-tunnel instructions.

Store the password in your secrets manager. In the commands below, <KVROCKS_PASSWORD> stands for the value of KVROCKS_PASSWORD.

Step 6 - Authenticate with redis-cli

Kvrocks requires the password (requirepass) and listens on port 6666. Authenticate and run PING:

redis-cli -p 6666 -a <KVROCKS_PASSWORD> --no-auth-warning ping

PONG

A wrong password is rejected with WRONGPASS, so the datastore is never open without the credential.

Step 7 - Store and retrieve data

Kvrocks speaks the Redis protocol, so every Redis command works unchanged. Set a string, read it back, increment a counter, and push to a list:

redis-cli -p 6666 -a <KVROCKS_PASSWORD> --no-auth-warning set greeting "hello from Kvrocks"
redis-cli -p 6666 -a <KVROCKS_PASSWORD> --no-auth-warning get greeting
redis-cli -p 6666 -a <KVROCKS_PASSWORD> --no-auth-warning set counter 100
redis-cli -p 6666 -a <KVROCKS_PASSWORD> --no-auth-warning incr counter
redis-cli -p 6666 -a <KVROCKS_PASSWORD> --no-auth-warning rpush mylist a b c
redis-cli -p 6666 -a <KVROCKS_PASSWORD> --no-auth-warning lrange mylist 0 -1

OK hello from Kvrocks OK 101 3 a b c

Step 8 - Confirm RocksDB persistence

Kvrocks persists all data with RocksDB in the directory /var/lib/kvrocks on the dedicated data disk. Confirm the keyspace, the data directory and the server details:

redis-cli -p 6666 -a <KVROCKS_PASSWORD> --no-auth-warning info keyspace
redis-cli -p 6666 -a <KVROCKS_PASSWORD> --no-auth-warning config get dir
redis-cli -p 6666 -a <KVROCKS_PASSWORD> --no-auth-warning info server | grep -iE 'kvrocks_version|rocksdb_version'

# Keyspace db0:keys=3,expires=0,avg_ttl=0,expired=0 used_disk_size:1705910272 dir /var/lib/kvrocks kvrocks_version:2.16.0 rocksdb_version:11.1.1

The data directory on the dedicated disk holds the RocksDB files, so the keyspace survives reboots. List the persisted RocksDB files:

sudo ls /var/lib/kvrocks

Step 9 - Connect remotely over an SSH tunnel

Kvrocks listens on 127.0.0.1:6666 only and is not exposed publicly, which is the secure default. To reach it from your workstation, open an SSH tunnel and point a local client at localhost:6666:

# On your workstation:
ssh -L 6666:127.0.0.1:6666 azureuser@<vm-public-ip>
# In another terminal, with a local redis-cli:
redis-cli -h 127.0.0.1 -p 6666 -a <KVROCKS_PASSWORD> --no-auth-warning ping

The authentication round-trip below shows the protection working. The wrong password is rejected and the correct one is accepted.

For remote access without a tunnel, bind Kvrocks to a private NIC and front it with TLS, for example with stunnel or a service mesh. Never expose 6666 to the internet without transport encryption.

Maintenance

• Persistence: the RocksDB data directory lives on the dedicated data disk at /var/lib/kvrocks, so the keyspace survives reboots, and you can resize the volume independently.
• Password: change it by editing requirepass in /etc/kvrocks/kvrocks.conf and running sudo systemctl restart kvrocks.
• Tuning: edit /etc/kvrocks/kvrocks.conf (for example workers, maxclients or rocksdb.block_cache_size) and restart the service.
• Security patches: unattended-upgrades remains enabled, so the OS continues to receive security updates automatically.
• Compatibility: Kvrocks is a Redis-protocol drop-in. Existing Redis clients, libraries and tooling work unchanged against 6666.

Support

SecureAnyCloud provides 24/7 expert support for this image. Contact sales@secureanycloud.com.

Apache Kvrocks and Apache are trademarks of the Apache Software Foundation. Redis is a trademark of Redis Ltd. This image is provided by SecureAnyCloud and is not affiliated with or endorsed by the Apache Software Foundation or Redis Ltd.

Deploy on Azure

Launch Apache Kvrocks on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

What You Get

• Apache Kvrocks 2.16.0 built from the official Apache source release, installed at /usr/local/bin/kvrocks
• redis-cli (from the redis-tools package) for a Redis-compatible command line
• kvrocks.service listening on 127.0.0.1:6666 (loopback only) with requirepass authentication enforced
• A per-instance password generated on first boot, written to /root/kvrocks-credentials.txt
• A dedicated 30 GiB gp3 data volume at /var/lib/kvrocks holding the RocksDB keyspace, independently resizable

Security Model

Kvrocks authenticates with a single shared password (requirepass) and has no transport encryption. The SecureAnyCloud image binds the service to loopback only (127.0.0.1:6666), so it is never exposed to the internet by default. The security group opens only SSH (port 22).

Reach Kvrocks remotely with an SSH tunnel (shown below) or by binding it to a private interface. Do not open port 6666 to the internet without terminating TLS in front of it.

Connecting to Your Instance

OS Variant SSH Login User

Ubuntu 24.04 ubuntu

Connect using your EC2 key pair:

ssh -i /path/to/key.pem ubuntu@<instance-public-ip>

Retrieving Your Kvrocks Password

On first boot, a one-shot service generates a strong 32-character password unique to your instance and writes it to a root-only file:

sudo cat /root/kvrocks-credentials.txt

Example output (your password will differ):

# Apache Kvrocks - generated on first boot by apache-kvrocks-firstboot.service
# This password is unique to this instance. Store it somewhere safe. KVROCKS_PASSWORD=<your-unique-password> KVROCKS_HOST=127.0.0.1 KVROCKS_PORT=6666 KVROCKS_PUBLIC_IP=203.0.113.10
# Local connection (on the instance):
# redis-cli -p 6666 -a '<your-unique-password>' ping -> PONG
# Connection string:
# redis://default:<your-unique-password>@127.0.0.1:6666/0
#
# IMPORTANT: Kvrocks listens on LOOPBACK ONLY (127.0.0.1) on port 6666 - it is NOT exposed
# publicly. For remote access open an SSH tunnel from your workstation.

Each example below reads the password from the credentials file into a KVPASS shell variable. The password is never printed on screen:

KVPASS=$(sudo grep '^KVROCKS_PASSWORD=' /root/kvrocks-credentials.txt | cut -d= -f2-)
echo "password loaded (${#KVPASS} chars)"

Verifying the Service

Confirm the installed version and that kvrocks.service is active:

/usr/local/bin/kvrocks --version systemctl status kvrocks.service --no-pager | head -6

Example output:

kvrocks version 2.16.0 * kvrocks.service - Apache Kvrocks (Redis-compatible, RocksDB-backed key-value store) Loaded: loaded (/etc/systemd/system/kvrocks.service; enabled; preset: enabled) Active: active (running) since Tue 2026-07-21 04:21:59 UTC; 27s ago Main PID: 20278 (kvrocks)

Confirm the listener is bound to loopback only (never 0.0.0.0):

ss -tln | grep 6666

Example output:

LISTEN 0 511 127.0.0.1:6666 0.0.0.0:*

Connecting with redis-cli

Kvrocks speaks the Redis protocol, so the standard redis-cli connects. Test with a PING:

KVPASS=$(sudo grep '^KVROCKS_PASSWORD=' /root/kvrocks-credentials.txt | cut -d= -f2-)
redis-cli -p 6666 -a "${KVPASS}" --no-auth-warning ping

Expected output:

PONG

View server information, which reports both the Kvrocks version and the Redis protocol version it emulates:

KVPASS=$(sudo grep '^KVROCKS_PASSWORD=' /root/kvrocks-credentials.txt | cut -d= -f2-)
redis-cli -p 6666 -a "${KVPASS}" --no-auth-warning info server | grep -iE 'kvrocks_version|redis_version|kvrocks_mode|^os'

Example output:

kvrocks_version:2.16.0 redis_version:7.0.0 kvrocks_mode:standalone os:Linux 6.17.0-1019-aws x86_64

Authentication Is Enforced

Connections without the password, or with the wrong password, are refused:

redis-cli -p 6666 ping
redis-cli -p 6666 -a wrongpassword --no-auth-warning ping

Expected output (both are rejected):

NOAUTH Authentication required. NOAUTH Authentication required.

Basic Operations

Kvrocks supports the common Redis data types. Store and retrieve a string:

KVPASS=$(sudo grep '^KVROCKS_PASSWORD=' /root/kvrocks-credentials.txt | cut -d= -f2-)
redis-cli -p 6666 -a "${KVPASS}" --no-auth-warning set greeting "hello from kvrocks"
redis-cli -p 6666 -a "${KVPASS}" --no-auth-warning get greeting

Expected output:

OK hello from kvrocks

Increment a counter:

KVPASS=$(sudo grep '^KVROCKS_PASSWORD=' /root/kvrocks-credentials.txt | cut -d= -f2-)
redis-cli -p 6666 -a "${KVPASS}" --no-auth-warning del visits
redis-cli -p 6666 -a "${KVPASS}" --no-auth-warning incr visits
redis-cli -p 6666 -a "${KVPASS}" --no-auth-warning incr visits

Expected output:

0 1 2

Push to a list and read it back:

KVPASS=$(sudo grep '^KVROCKS_PASSWORD=' /root/kvrocks-credentials.txt | cut -d= -f2-)
redis-cli -p 6666 -a "${KVPASS}" --no-auth-warning del tasks
redis-cli -p 6666 -a "${KVPASS}" --no-auth-warning rpush tasks build test deploy
redis-cli -p 6666 -a "${KVPASS}" --no-auth-warning lrange tasks 0 -1

Expected output:

0 3 build test deploy

On-Disk Persistence

Kvrocks persists to disk through RocksDB, so data survives service restarts and reboots. To confirm this, write a key, restart the service, wait for it to reopen the store, and read it back:

KVPASS=$(sudo grep '^KVROCKS_PASSWORD=' /root/kvrocks-credentials.txt | cut -d= -f2-)
redis-cli -p 6666 -a "${KVPASS}" --no-auth-warning set durable "survives-restart"
sudo systemctl restart kvrocks.service for i in $(seq 1 30); do redis-cli -p 6666 -a "${KVPASS}" --no-auth-warning ping 2>/dev/null | grep -q PONG && break sleep 1 done redis-cli -p 6666 -a "${KVPASS}" --no-auth-warning get durable

Expected output:

OK survives-restart

Data Volume

The RocksDB keyspace lives on a dedicated 30 GiB gp3 volume mounted at /var/lib/kvrocks, separate from the OS disk and independently resizable:

df -h /var/lib/kvrocks findmnt /var/lib/kvrocks

Example output:

Filesystem Size Used Avail Use% Mounted on /dev/nvme1n1 30G 4.8M 28G 1% /var/lib/kvrocks TARGET SOURCE FSTYPE OPTIONS /var/lib/kvrocks /dev/nvme1n1 ext4 rw,relatime

Remote Access via an SSH Tunnel

Because Kvrocks binds to loopback only, connect a client on your workstation through an SSH tunnel. From your machine:

ssh -i /path/to/key.pem -L 6666:127.0.0.1:6666 ubuntu@<instance-public-ip>

Leave that session open. In another terminal on your workstation, point redis-cli at localhost:

redis-cli -p 6666 -a '<your-unique-password>' ping

The tunnel forwards localhost:6666 on your machine to 127.0.0.1:6666 on the instance, so Kvrocks stays unexposed to the internet.

Configuration

The Kvrocks configuration file is /etc/kvrocks/kvrocks.conf (owned root:kvrocks, mode 640). Key directives set by sac:

bind 127.0.0.1 port 6666 workers 2 dir /var/lib/kvrocks requirepass <your-unique-password>

After editing, restart the service to apply changes:

sudo systemctl restart kvrocks.service

Changing the Password

Edit the requirepass directive and restart the service:

NEW_PASS=$(openssl rand -base64 48 | tr -dc 'A-Za-z0-9' | cut -c1-32) sudo sed -i -E "s|^[[:space:]]*requirepass[[:space:]].*|requirepass ${NEW_PASS}|" /etc/kvrocks/kvrocks.conf
sudo systemctl restart kvrocks.service

Then update /root/kvrocks-credentials.txt with the new password for future reference. This rotates the live password, so run it only when you intend to change credentials.

Backup and Maintenance

The entire keyspace lives under /var/lib/kvrocks. For a consistent snapshot, stop the service, archive the directory, and restart:

sudo systemctl stop kvrocks.service
sudo tar -czf /tmp/kvrocks-backup-$(date +%F).tar.gz -C /var/lib/kvrocks .
sudo systemctl start kvrocks.service

For live backups and replication, consult the upstream Kvrocks documentation on the BGSAVE-style snapshotting and replica configuration it supports.

Support

24/7 technical support is available from SecureAnyCloud at secureanycloud.com. Support covers Kvrocks deployment, RocksDB and persistence tuning, Redis-protocol client compatibility, replication planning, credential management, and version upgrades.

Deploy on AWS

Launch Apache Kvrocks on AWS with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com