Redis 8

Open the Marketplace in the Azure Portal, search for Redis 8, select the SecureAnyCloud publisher entry, and select Create.

On the Networking tab, attach a network security group that allows inbound TCP 22 from your management IP range and TCP 6379 from your application VMs. Do not expose port 6379 to the public internet. Even with requirepass enabled, brute-force attacks against weak passwords are a real risk, and Redis without TLS sends the password in cleartext on the wire.

Select Review + create, wait for validation, then select Create. Deployment takes around two minutes.

RG="redis-prod" LOCATION="eastus" VM_NAME="redis-01" ADMIN_USER="azureuser" IMAGE_URN="sac1647283583153:redis-8-ubuntu-24-04:default:latest" SSH_KEY="$(cat ~/.ssh/id_rsa.pub)" az group create --name "$RG" --location "$LOCATION" az network vnet create --resource-group "$RG" --name redis-vnet \
  --address-prefix 10.98.0.0/16 --subnet-name redis-subnet --subnet-prefix 10.98.1.0/24 az network nsg create --resource-group "$RG" --name redis-nsg az network nsg rule create --resource-group "$RG" --nsg-name redis-nsg \
  --name allow-ssh --priority 100 \
  --source-address-prefixes "<your-mgmt-cidr>" \
  --destination-port-ranges 22 --access Allow --protocol Tcp az network nsg rule create --resource-group "$RG" --nsg-name redis-nsg \
  --name allow-redis --priority 110 \
  --source-address-prefixes 10.98.0.0/16 \
  --destination-port-ranges 6379 --access Allow --protocol Tcp
# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:redis-8-ubuntu-24-04:default:latest
az vm create \
  --resource-group "$RG" --name "$VM_NAME" \
  --image "$IMAGE_URN" \
  --size Standard_B2s --storage-sku StandardSSD_LRS \
  --admin-username "$ADMIN_USER" --ssh-key-values "$SSH_KEY" \
  --vnet-name redis-vnet --subnet redis-subnet --nsg redis-nsg \
  --public-ip-sku Standard

ssh azureuser@<vm-ip>

By the time you connect, redis-server.service is already running and redis-firstboot.service has already generated the requirepass.

sudo systemctl status redis-server.service --no-pager

The expected status is active (running). Confirm the first-boot sentinel:

sudo test -f /var/lib/sac/data/redis-firstboot.done && echo FIRSTBOOT_DONE

Confirm that the listener is bound on port 6379:

sudo ss -tln | grep 6379

By default, Redis binds to 127.0.0.1 only, shown as LISTEN 0 511 127.0.0.1:6379. To allow remote connections, edit /etc/redis/redis.conf and change bind 127.0.0.1 to bind 0.0.0.0 (or your VM's private IP). Then run sudo systemctl restart redis-server.

The Redis requirepass is generated for this specific VM and written to a root-only file. Read it with:

sudo cat /stage/scripts/redis-credentials.log

The output looks similar to this:

REDIS_USER=default REDIS_PASSWORD=<REDIS_PASSWORD> LISTEN_PORT=6379 LISTEN_ADDRESS=127.0.0.1

Store the password in your secret store. To rotate it, edit /etc/redis/conf.d/sac-auth.conf and run sudo systemctl restart redis-server.

For a hot rotation, use redis-cli -a '<old>' CONFIG SET requirepass '<new>'. Then update sac-auth.conf so that the new password survives a restart.

PASS=$(sudo grep '^REDIS_PASSWORD=' /stage/scripts/redis-credentials.log | cut -d= -f2-)
redis-cli -a "${PASS}" --no-auth-warning PING

The expected reply is PONG. The --no-auth-warning flag suppresses the harmless "Using a password with '-a' or '-u' option on the command line interface may not be safe" warning. This is fine in scripts. For interactive sessions, start redis-cli and enter AUTH <password> at the prompt instead.

Confirm the version:

redis-cli -a "${PASS}" --no-auth-warning INFO server | grep redis_version

Confirm that anonymous access is rejected:

redis-cli PING

The expected reply is (error) NOAUTH Authentication required.

The default Redis user (with requirepass) has full access. Set, get and delete a sample key:

PASS=$(sudo grep '^REDIS_PASSWORD=' /stage/scripts/redis-credentials.log | cut -d= -f2-)
redis-cli -a "${PASS}" --no-auth-warning SET sac:probe 'sac-ok'
redis-cli -a "${PASS}" --no-auth-warning GET sac:probe
redis-cli -a "${PASS}" --no-auth-warning DEL sac:probe

The expected replies are OK, then "sac-ok", then (integer) 1.

Redis 8 ships with Vector Sets, JSON, Time Series and Bloom filters built into the core engine, with no separate RedisStack modules. The following examples show each type.

Vector Sets (similarity search):

redis-cli -a "${PASS}" --no-auth-warning VADD myindex VALUES 4 0.1 0.2 0.3 0.4 alice
redis-cli -a "${PASS}" --no-auth-warning VADD myindex VALUES 4 0.5 0.5 0.5 0.5 bob
redis-cli -a "${PASS}" --no-auth-warning VSIM myindex VALUES 4 0.1 0.2 0.3 0.4 COUNT 2

JSON:

redis-cli -a "${PASS}" --no-auth-warning JSON.SET user:1 '$' '{"name":"alice","age":30}'
redis-cli -a "${PASS}" --no-auth-warning JSON.GET user:1 '$.name'

Time Series:

redis-cli -a "${PASS}" --no-auth-warning TS.CREATE temperature
redis-cli -a "${PASS}" --no-auth-warning TS.ADD temperature '*' 21.5
redis-cli -a "${PASS}" --no-auth-warning TS.RANGE temperature - +

From any host inside the same virtual network, install a Redis client library and connect on port 6379 with the per-VM password.

Python (pip install redis):

import redis r = redis.Redis(host='<vm-private-ip>', port=6379, password='<REDIS_PASSWORD>') r.set('hello', 'world') print(r.get('hello'))

Node.js (npm install redis):

import { createClient } from 'redis'; const client = createClient({ url: 'redis://default:<REDIS_PASSWORD>@<vm-private-ip>:6379' }); await client.connect(); await client.set('hello', 'world'); console.log(await client.get('hello'));

Do not open port 6379 to the public internet without TLS termination. The Redis cleartext protocol sends the AUTH password over the wire unencrypted. For production, configure tls-port 6380 and certificate files in redis.conf, and bind the cleartext port to loopback only.

Component Path

Redis binary /usr/bin/redis-server

redis-cli /usr/bin/redis-cli

redis-benchmark /usr/bin/redis-benchmark

Main config /etc/redis/redis.conf

Drop-in conf.d /etc/redis/conf.d/*.conf (sac-auth.conf written at first boot)

Data directory /var/lib/redis

RDB file /var/lib/redis/dump.rdb

AOF directory /var/lib/redis/appendonlydir/ (when enabled)

Log file /var/log/redis/redis-server.log

Systemd unit /lib/systemd/system/redis-server.service

First-boot script /usr/local/sbin/redis-firstboot.sh

First-boot service /etc/systemd/system/redis-firstboot.service

Credentials file /stage/scripts/redis-credentials.log (mode 0600)

First-boot sentinel /var/lib/sac/data/redis-firstboot.done

Inspect the running version:

/usr/bin/redis-server --version

Check the status:

sudo systemctl status redis-server.service --no-pager

Stop, start or restart the service:

sudo systemctl stop redis-server.service
sudo systemctl start redis-server.service
sudo systemctl restart redis-server.service

View the log:

sudo tail -f /var/log/redis/redis-server.log

Reload configuration without a restart (supported keys only):

PASS=$(sudo grep '^REDIS_PASSWORD=' /stage/scripts/redis-credentials.log | cut -d= -f2-)
redis-cli -a "${PASS}" --no-auth-warning CONFIG GET maxmemory
redis-cli -a "${PASS}" --no-auth-warning CONFIG SET maxmemory 1gb

Some settings, such as bind, do not support hot reload. For those, edit /etc/redis/redis.conf and run systemctl restart redis-server.

Trigger an RDB snapshot:

redis-cli -a "${PASS}" --no-auth-warning BGSAVE

Enable AOF for write durability:

echo 'appendonly yes' | sudo tee /etc/redis/conf.d/sac-aof.conf
sudo systemctl restart redis-server

(error) NOAUTH Authentication required.

Always pass -a '<password>' or run AUTH <password> first.

Confirm that the password is current with sudo cat /stage/scripts/redis-credentials.log.

Could not connect to Redis at 127.0.0.1:6379: Connection refused

Service down: check it with sudo systemctl status redis-server.

Listener on a different port or address: check it with sudo ss -tln | grep 6379.

Disk full, preventing AOF or RDB writes: check it with df -h /var/lib/redis.

OOM command not allowed when used memory > 'maxmemory'

The instance reached its memory cap, and the eviction policy is not evicting keys.

Either raise maxmemory, or change maxmemory-policy from noeviction to allkeys-lru.

MISCONF Redis is configured to save RDB snapshots but currently is not able to persist on disk

The RDB snapshot failed, usually because the disk is full or a permission error occurred.

Check /var/log/redis/redis-server.log for the underlying error.

To free disk space, run sudo journalctl --vacuum-time=7d and sudo apt-get clean.

• Rotate the requirepass immediately after deployment, as described in Step 5.
• Restrict the NSG so that port 6379 is reachable only from your application VMs and admin networks. Never expose it to the public internet.
• Enable TLS (tls-port 6380 and certificate files in redis.conf) for any cross-VM connection, because the Redis cleartext protocol sends AUTH passwords unencrypted.
• Disable or rename dangerous commands in production with rename-command FLUSHALL '', rename-command CONFIG '' and similar directives.
• Use ACLs (ACL SETUSER) for fine-grained per-application permissions instead of relying solely on requirepass.
• Set maxmemory and a sensible maxmemory-policy: allkeys-lru for caches, noeviction for a source of truth.
• Enable persistence. RDB snapshots are on by default, and you can enable AOF for write-heavy durability.
• Back up /var/lib/redis/dump.rdb and appendonlydir/ to Azure Blob Storage on a schedule.
• Patch the OS monthly with sudo apt-get update && sudo apt-get upgrade && sudo reboot.

Redis 8 ships under the AGPL-3.0 license (Redis Inc. switched from BSD-3 in 2024 and from RSALv2/SSPL in 2025). The AGPL adds copyleft requirements for modifications you distribute and network-accessible derivative services. For almost all customers who run stock Redis as a backing store for an application, this changes nothing in practice.

If you fork the source and distribute it, you must publish your changes. If you offer Redis as a service to third parties as a managed product, you must also publish your source changes.

SecureAnyCloud provides commercial support for this image, separately from the upstream project.

Email: sales@secureanycloud.com

Website: secureanycloud.com

Support hours: 24/7 with guaranteed 24 hour response SLA

Deploy on Azure

Launch Redis 8 on Ubuntu 24.04 with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure

Launch Redis 8 on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com