Pika

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region. Standard_B2s (2 vCPU / 4 GiB RAM) is a good starting point.

Configure these NSG inbound rules. Allow 22/tcp from your management network. Open 9221/tcp only if you need direct remote access from a trusted network, because Pika requires the password but has no TLS.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure portal, choose Create a resource, and search the Marketplace for Pika by SecureAnyCloud. Select Create.

On Basics, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) only. Then choose Review + create, followed by Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:pika-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name pika \
  --image sac1647283583153:pika-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm Pika is installed and running

/opt/pika/bin/pika -v systemctl is-active pika

The output shows Pika 3.5.6 and active:

-----------Pika server---------- pika_version: 3.5.6 pika_git_sha:25b18c3853bd803da42340838087b93564a1701d pika_build_compile_date: 2025-09-09 15:13:25 active

Step 5 - Retrieve your per-VM password

Each VM generates its own unique Pika password on first boot. It writes the password to a root-only credentials file:

sudo cat /root/pika-credentials.txt

PIKA_PASSWORD=<your-unique-password> PIKA_HOST=10.0.0.20 PIKA_PORT=9221 PIKA_PUBLIC_IP=10.0.0.20

The file also contains the redis-cli connection string and the SSH tunnel instructions. Store the password in your secrets manager. In the commands below, <PIKA_PASSWORD> stands for the value of PIKA_PASSWORD.

Step 6 - Authenticate with redis-cli

Pika requires the password on every connection. Pika accepts any password when its user tier is left open. For this reason, the SecureAnyCloud image sets both requirepass and userpass to the same per-VM password, and a wrong password is rejected.

Authenticate and run a PING:

redis-cli -p 9221 -a <PIKA_PASSWORD> --no-auth-warning ping

PONG

Without the password, or with a wrong one, the datastore refuses the connection:

redis-cli -p 9221 ping
redis-cli -p 9221 -a wrongpass --no-auth-warning ping

ERR NOAUTH Authentication required. AUTH failed: WRONGPASS invalid username-password pair or user is disabled. ERR NOAUTH Authentication required.

Step 7 - Store and retrieve data

Pika speaks the Redis protocol, so every standard Redis command works unchanged. Set a string, read it back, increment a counter and push to a list:

redis-cli -p 9221 -a <PIKA_PASSWORD> --no-auth-warning set greeting "hello from Pika"
redis-cli -p 9221 -a <PIKA_PASSWORD> --no-auth-warning get greeting
redis-cli -p 9221 -a <PIKA_PASSWORD> --no-auth-warning set counter 100
redis-cli -p 9221 -a <PIKA_PASSWORD> --no-auth-warning incr counter
redis-cli -p 9221 -a <PIKA_PASSWORD> --no-auth-warning rpush mylist a b c
redis-cli -p 9221 -a <PIKA_PASSWORD> --no-auth-warning lrange mylist 0 -1

OK hello from Pika OK 101 3 a b c

Step 8 - Confirm persistence on the dedicated data disk

Unlike Redis, Pika stores the dataset on disk in RocksDB, so your keyspace is not bounded by RAM and survives restarts. The RocksDB data, logs and dumps live on the dedicated Azure data disk mounted at /var/lib/pika.

Confirm the server details and that the dataset is on the data disk:

redis-cli -p 9221 -a <PIKA_PASSWORD> --no-auth-warning info server | grep -iE 'pika_version|config_file|os:' findmnt -no SOURCE,TARGET,FSTYPE /var/lib/pika ls -la /var/lib/pika/db

pika_version:3.5.6 os:Linux 6.17.0-1020-azure x86_64 config_file:/etc/pika/pika.conf /dev/sdc /var/lib/pika ext4 drwxr-xr-x 8 pika pika 4096 Jul 19 03:41 db0

The RocksDB directory db0 on /dev/sdc (the dedicated data disk) is the durable dataset. Snapshot the disk to back up your keyspace, or resize it independently of the OS disk.

Step 9 - Connect remotely

Pika listens on port 9221 and requires the password, so there is no unauthenticated access. It has no transport encryption.

The secure default for untrusted networks is an SSH tunnel. Forward the port over SSH and point a local client at localhost:9221:

# On your workstation:
ssh -L 9221:127.0.0.1:9221 azureuser@<vm-public-ip>
# In another terminal, with a local redis-cli:
redis-cli -h 127.0.0.1 -p 9221 -a <PIKA_PASSWORD> --no-auth-warning ping

For direct remote access from a trusted network, you can instead open 9221/tcp in the VM's NSG and connect to redis-cli -h <vm-public-ip> -p 9221 -a <PIKA_PASSWORD>. The password is required either way.

Never expose 9221 to the public internet without transport encryption. Front it with stunnel, a service mesh or a private NIC.

Maintenance

• Persistence: the RocksDB dataset, logs and dumps live on the dedicated data disk at /var/lib/pika, so the keyspace survives reboots and the volume is independently resizable.
• Password: to change it, edit requirepass and userpass in /etc/pika/pika.conf, then run sudo systemctl restart pika.
• Tuning: edit /etc/pika/pika.conf (for example maxmemory, thread-num and thread-pool-size), then restart the service.
• Security patches: unattended-upgrades stays enabled, so the operating system keeps receiving security updates automatically.
• Compatibility: Pika speaks the Redis protocol, so existing Redis clients, libraries and tooling work unchanged against 9221.

Support

SecureAnyCloud provides 24/7 expert support for this image. Contact sales@secureanycloud.com.

Pika is a project of the OpenAtom Foundation. Redis is a trademark of Redis Ltd. This image is provided by SecureAnyCloud and is not affiliated with or endorsed by the OpenAtom Foundation or Redis Ltd.

Deploy on Azure

Launch Pika on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com