Hosting Redis on a VPS: the complete guide

Why self-host Redis on a VPS

The concrete benefits of a self-hosted Redis

• Sub-millisecond latency if Redis runs on the same VPS or the same private network as your app.
• Control of maxmemory and the eviction policy according to your cache or job-queue use case.
• Persistence of your choice: RDB (snapshots), AOF (journal), or both for durability.
• RAM cost without overcharging: you pay the VPS plan, not premium memory by the GB.
• Free modules: RediSearch, RedisJSON, RedisBloom as needed.
• No arbitrary cap on the number of simultaneous client connections.

Hardware and software prerequisites

Deploying Redis with Docker in production

1. 01

   Prepare the host

   Install Docker, then set vm.overcommit_memory=1 via sysctl to make snapshots reliable, and disable Transparent Huge Pages. Close port 6379 to the outside: a Redis exposed without a password is a classic target for cryptominers.

   # Persistent via sysctl.conf
   echo 'vm.overcommit_memory = 1' >> /etc/sysctl.conf
   sysctl -p
   # Disable THP
   echo never > /sys/kernel/mm/transparent_hugepage/enabled

2. 02

   Write the docker-compose.yml

   Declare a redis:7-alpine service with a custom command pointing to a redis.conf mounted as read-only. Enable requirepass, set maxmemory and maxmemory-policy, and mount a volume for /data if you want persistence.

   services:
     redis:
       image: redis:7-alpine
       command: redis-server /etc/redis/redis.conf
       volumes:
         - ./redis.conf:/etc/redis/redis.conf:ro
         - redis_data:/data
       restart: unless-stopped
       ports:
         - "127.0.0.1:6379:6379"
   volumes:
     redis_data:

3. 03

   Configure security

   In redis.conf, security rests on several complementary layers. The first is network binding: bind 127.0.0.1 or your private network IP — never listen on 0.0.0.0 without additional protection. The second is authentication: requirepass YOUR_STRONG_PASSWORD for Redis 6 and earlier; for Redis 7, prefer ACLs which allow creating users with granular permissions:

   bind 127.0.0.1
   requirepass YOUR_STRONG_PASSWORD
   # Redis 7 ACL: read-only user for your app
   aclfile /etc/redis/users.acl
   # Disable dangerous commands
   rename-command FLUSHALL ""
   rename-command CONFIG ""
   rename-command DEBUG ""

   The users.acl file can declare:

   user app_user on >PASSWORD ~* +@read +@write -@dangerous
   user default off

   For encrypted remote access, enable Redis native TLS (available since Redis 6):

   tls-port 6380
   tls-cert-file /certs/redis.crt
   tls-key-file /certs/redis.key
   tls-ca-cert-file /certs/ca.crt

   Alternatively, an SSH tunnel or VPN is enough for most cases without TLS complexity.

4. 04

   Choose the persistence strategy

   Redis offers two persistence mechanisms, which can be combined.

   RDB (snapshot): Redis writes a dataset snapshot to disk at configurable intervals. Fast on restart, but you lose data written since the last snapshot in case of crash.

   # Snapshot if 1 key changes in 900s, 10 keys in 300s, 10000 keys in 60s
   save 900 1
   save 300 10
   save 60 10000

   AOF (Append-Only File): every write command is journaled. Safer, slightly slower. appendfsync everysec is the right trade-off: at most 1 second of data lost.

   appendonly yes
   appendfsync everysec
   auto-aof-rewrite-percentage 100
   auto-aof-rewrite-min-size 64mb

   Combining RDB + AOF: on restart, Redis uses the AOF (more complete), while RDB accelerates periodic full backups. This is the recommended strategy for critical job brokers.

   For a pure cache where data loss is acceptable, disable persistence: save "" and appendonly no — you gain performance and disk space.

5. 05

   Connect your application

   Launch with docker compose up -d and test with docker compose exec redis redis-cli -a YOUR_PASS ping. Point your application to the internal Docker network rather than a public IP, for both latency and security.

   # Connectivity test
   docker compose exec redis redis-cli -a YOUR_PASS ping
   # PONG
   
   # Check active configuration
   docker compose exec redis redis-cli -a YOUR_PASS CONFIG GET maxmemory

   For applications on the same Docker host, use the service name as the host (redis:6379) rather than localhost or the public IP.

6. 06

   Monitor memory

   Monitor used_memory and evicted_keys via redis-cli INFO. If evictions rise, increase the RAM or refine the policy. Set up an alert when memory usage exceeds 80% of maxmemory.

   # Redis health overview
   redis-cli -a YOUR_PASS INFO memory | grep -E 'used_memory_human|maxmemory_human|mem_fragmentation_ratio'
   redis-cli -a YOUR_PASS INFO stats | grep -E 'evicted_keys|keyspace_hits|keyspace_misses'

   A mem_fragmentation_ratio above 1.5 indicates significant fragmentation: a MEMORY PURGE or a rolling restart may help.

7. 07

   Logging in for the first time

   Open the URL: RedisInsight appears straight away, WITHOUT asking for any credentials at all (you only accept the terms of use on the first screen), and your local Redis database is already accessible there for reading and writing. Do not attach a public domain to this interface without protection in front of it.

Troubleshooting: the most common errors

• MISCONF Redis is configured to save RDB snapshots, but it's currently unable to persist on disk — Redis is attempting a snapshot but the fork fails. Cause: vm.overcommit_memory is set to 0 on the host. Fix: sysctl vm.overcommit_memory=1 (permanent in /etc/sysctl.conf). If you use Docker, this parameter must be set on the Docker host, not inside the container.
• ERR max number of clients reached — The number of simultaneous connections exceeds maxclients (default: 10,000). Common causes: misconfigured connection pool on the application side (Sidekiq, Laravel Horizon, etc.) or unclosed connections. Fix: increase maxclients in redis.conf and check the pool configuration on the app side. The command redis-cli CLIENT LIST lists active connections.
• OOM Killer kills the Redis process — The Linux kernel kills Redis due to lack of free memory. Cause: maxmemory not set or too generous, combined with the copy-on-write of the RDB fork. Fix: set maxmemory to 60-70% of available RAM, choose an eviction policy (maxmemory-policy allkeys-lru for a cache, noeviction for a broker), and plan for 2× the dataset for the RDB fork. Monitor /var/log/syslog for Out of memory: Kill process messages.
• Could not create server TCP listening socket 0.0.0.0:6379: bind: Address already in use — Another process is occupying port 6379. Identify it with ss -tlnp | grep 6379 and stop it, or change the Redis port in your configuration. On VPS with a Redis instance installed via apt, the system service may conflict with your Docker container.

High availability: Sentinel and Cluster

Updates and Valkey as an alternative