Deployment

How redis-server runs in production. This page collects the operationally-significant choices that aren't strictly part of any one subsystem.

Single-process, single-host

The simplest deployment is one redis-server process on a host. Configuration via redis.conf. Service management via systemd (utils/systemd-redis_server.service) or sysvinit (utils/redis_init_script).

For multiple instances on one host the templated unit utils/systemd-redis_multiple_servers@.service lets you run systemctl start redis_multiple_servers@7000, redis_multiple_servers@7001, etc.

Replication

Two-host pattern: one primary, one or more replicas. Configure the replica:

replicaof <primary-host> <primary-port>
masterauth <password>            # if the primary requires AUTH
replica-read-only yes            # default

A replica catches up via PSYNC2 or full sync (RDB transfer) on connect. See Replication for the protocol details.

Sentinel

Sentinel deploys at least three instances on three separate hosts. Each Sentinel monitors the same set of primaries and elects a leader for failover. Configuration via sentinel.conf. See redis-sentinel.

Cluster

For sharded deployments use cluster mode (cluster-enabled yes). Recommended topology:

• 3+ master nodes (one per shard).
• 1+ replicas per master.
• Distributed across 3+ availability zones.

Bootstrap with redis-cli --cluster create node1:port node2:port .... See Cluster.

Networking

Option	Purpose
bind 0.0.0.0 ::	Listen on all interfaces. The default 127.0.0.1 -::1 is loopback-only.
port 6379	Data port.
tls-port 6380	TLS-only data port.
tcp-backlog 511	listen() backlog. Increase past net.core.somaxconn if needed.
tcp-keepalive 300	TCP keepalive interval (seconds).
protected-mode yes	Refuse external connections if no auth and bound to all interfaces.

TLS

Enable TLS in the build (make BUILD_TLS=yes) and configure:

tls-port 6380
port 0                    # turn off plaintext if you want TLS-only
tls-cert-file /etc/redis/redis.crt
tls-key-file /etc/redis/redis.key
tls-ca-cert-file /etc/redis/ca.crt
tls-auth-clients yes      # require client certs
tls-cluster yes           # also use TLS for cluster bus
tls-replication yes       # TLS for replication
tls-protocols "TLSv1.2 TLSv1.3"

See ACL & security.

Persistence

Option	Choice
save <seconds> <changes>	RDB snapshot triggers. Multiple lines OK. Empty (no save) disables periodic RDB.
appendonly yes	Enable AOF.
appendfsync everysec	Default. always is safer but ~10× slower; no lets the OS flush.
auto-aof-rewrite-percentage 100, auto-aof-rewrite-min-size 64mb	When to rewrite.
aof-use-rdb-preamble yes	Default. Faster rewrite, smaller files.
dir /var/lib/redis	Working directory (RDB and AOF live here).

For maximum durability: AOF on, appendfsync everysec plus WAIT n timeout from clients to wait for replica acknowledgement.

For maximum throughput on a cache that can lose data: AOF off, RDB off. Reload from upstream if the process dies.

Memory

Cap the dataset:

maxmemory 4gb
maxmemory-policy allkeys-lru
maxmemory-samples 10

With maxmemory 0 (default) the server will use as much memory as the OS lets it.

For large heaps, transparent huge pages should be disabled — Redis explicitly recommends echo never > /sys/kernel/mm/transparent_hugepage/enabled. The startup syscheck (src/syscheck.c) warns if THP is on.

vm.overcommit_memory = 1 is required for fork() to succeed when the parent is using more than half of physical RAM. Without it, BGSAVE / BGREWRITEAOF can fail with ENOMEM.

CPU pinning

server-cpulist 0-3
bio-cpulist 4
io-threads-cpulist 5-7
aof-rewrite-cpulist 8
bgsave-cpulist 9

Useful on dedicated hosts where you want NUMA locality. See IO threads for the threading model.

Monitoring

INFO is the main metric source. For Prometheus, use a sidecar like redis_exporter that scrapes INFO periodically. Key metrics:

• instantaneous_ops_per_sec — throughput.
• used_memory_dataset_perc — fraction of maxmemory consumed.
• mem_fragmentation_ratio — RSS / used. > 1.5 suggests defrag is needed.
• connected_clients, blocked_clients.
• keyspace_hits / keyspace_misses — cache hit ratio.
• expired_keys, evicted_keys — pressure indicators.
• master_repl_offset, replica lag.

Latency monitor (latency-monitor-threshold) records spikes; LATENCY GRAPH and LATENCY DOCTOR provide operator-friendly summaries.

The slowlog (SLOWLOG GET 100) is the easiest way to find expensive commands.

Backups

For RDB-based deployments, copy dump.rdb (in dir) periodically to off-host storage. The file is consistent — the BGSAVE child fsync's it before exit.

For AOF, the multi-part files in dir form a complete backup once the manifest is consistent. Use redis-check-aof to validate before restoring.

BGSAVE triggers a manual snapshot. BGREWRITEAOF triggers a manual AOF rewrite (which produces a fresh base + reset incremental).

Upgrades

In-place upgrade flow for a non-clustered deployment:

1. BGSAVE and copy the RDB off-host (insurance).
2. Stop the old server (SHUTDOWN).
3. Replace the binary.
4. Start the new server. It loads the same RDB/AOF.

For a primary-replica pair: upgrade the replica first, fail over to it (REPLICAOF NO ONE), upgrade the original primary, fail back if desired.

For a cluster: upgrade replicas first, then trigger a CLUSTER FAILOVER per shard to promote the upgraded replica, then upgrade the demoted node.

redis-server --version and INFO server both show the version. Cross-version compatibility for RDB and AOF is forward only — never downgrade an RDB file to a server that was released before the file's version.

Resource limits

Bump ulimit -n (open file descriptors) above maxclients + 32 (for internal sockets). The server checks at startup and either resizes its limit (via setrlimit) or refuses to start with a clear message.

Container

The official Docker images (redis, redis:alpine) wrap the same binary. Caveats:

• The default image runs as a non-root user (redis).
• dir is /data and is meant to be a volume mount.
• --save 60 1 is set by default.
• TLS is built-in but not enabled by default; supply your certs and use --tls-port.

Where to start

• Operator runbook — see Debugging for incident-time tools.
• Persistence trade-offs — Persistence.
• Replication topology — Replication.
• Cluster topology — Cluster.