How to install Redis on a VPS: memory limits, persistence and a password that sticks

Redis keeps data in memory and answers in about a millisecond, which is why it sits behind so many apps as a cache, a queue or a session store. The install is one command. The work is in the defaults: no memory limit, snapshots that can lose recent writes, and two easy mistakes that quietly wipe your data or switch off your password. This guide covers all of it on Ubuntu 24.04. We ran each step on our image; the numbers come from a Micro server (2 vCPU, 2 GB).

You need a user with sudo. The Ubuntu setup guide creates one.

1. Install

sudo apt update
sudo apt install -y redis-server
redis-server --version
redis-cli ping

The install took 13 seconds and gave us Redis 7.0.15. It starts at once and at every boot, answers PONG, and listens only on the server itself: 127.0.0.1:6379 and [::1]:6379, with protected-mode yes. It used 13.5 MB of RAM with no data.

The log already had a warning:

WARNING Memory overcommit must be enabled! Without it, a background save or replication may fail under low memory condition.

Redis saves to disk from a forked copy of itself, and with the kernel's default setting that fork can fail when memory is tight. Fix it once:

echo 'vm.overcommit_memory = 1' | sudo tee /etc/sysctl.d/90-redis.conf
sudo sysctl -p /etc/sysctl.d/90-redis.conf
sudo systemctl restart redis-server

After the restart the warning was gone.

2. Limit its memory

Out of the box maxmemory is 0, which means no limit, and the policy is noeviction. Redis will keep taking RAM until the server runs out. Set a ceiling and decide what happens when Redis reaches it:

redis-cli CONFIG SET maxmemory 256mb
redis-cli CONFIG SET maxmemory-policy allkeys-lru
redis-cli CONFIG REWRITE

We tested both policies with a 64 MB limit and 400,000 writes:

• noeviction (the default): memory stopped at 63 MB and new writes failed with OOM command not allowed when used memory > 'maxmemory'. Right for a queue or anything you can't afford to drop.
• allkeys-lru: Redis dropped the least recently used keys, 48,606 of them, and every write went through. Right for a cache.

CONFIG REWRITE saves the running settings into /etc/redis/redis.conf, so they survive a restart. It also adds a line you need to know about before step 4.

3. Choose how it saves to disk

By default Redis writes a snapshot (/var/lib/redis/dump.rdb) after 1 change in an hour, 100 in five minutes or 10,000 in a minute. We tested three ways of stopping it:

In both cases systemd started Redis again by itself within seconds.

If Redis holds data you'd miss, turn on the append-only file (AOF). It records every write and flushes it to disk once a second. Do it on the running server, not by editing the file:

redis-cli CONFIG SET appendonly yes
redis-cli CONFIG REWRITE
redis-cli INFO persistence | grep aof_

We tried the other way first, and it cost us our data. We changed appendonly no to appendonly yes in redis.conf and restarted. Redis came back with an empty AOF and loaded nothing from the snapshot, so every existing key was gone. When it shut down later, it saved its new contents, without the old keys, over dump.rdb too. CONFIG SET avoids this: Redis first writes the AOF from the data in memory. After a restart, all our keys were there.

If Redis is a pure cache that can start empty, go the other way and turn saving off with redis-cli CONFIG SET save "".

4. Set a password

Here is the second trap. After any CONFIG REWRITE, Redis 7 adds this line at the end of redis.conf:

user default on nopass ~* &* +@all

It means "the default user needs no password". We then added requirepass higher up in the file and restarted. Redis still answered PONG with no password, because the user line overrides it. Set the password through Redis instead:

REDIS_PASS=$(openssl rand -hex 24)
echo "$REDIS_PASS"
redis-cli CONFIG SET requirepass "$REDIS_PASS"
REDISCLI_AUTH="$REDIS_PASS" redis-cli CONFIG REWRITE

Save the password somewhere safe. Redis now stores it as a SHA-256 hash in that same user default line. After a restart, redis-cli ping returned NOAUTH Authentication required. and only the password worked. Give it to redis-cli through the REDISCLI_AUTH variable. With -a it shows up in the process list, and redis-cli warns you about that. In your app, put it in the Redis URL: redis://:PASSWORD@127.0.0.1:6379/0.

5. Reach it from your computer

Keep Redis on 127.0.0.1 and use an SSH tunnel. Use your server's SSH port, which on NAT plans is your personal port:

ssh -N -L 6380:127.0.0.1:6379 deploy@YOUR_SERVER_IP -p 22

While that runs, redis-cli -p 6380 and desktop tools on your computer talk to the server's Redis. Nothing new is open to the internet. The SSH key guide makes the tunnel log in without a password.

How fast it is

On the Micro test server, redis-benchmark with 50 clients gave us:

For a web app's cache or job queue, that's far more than you'll need. Sending commands in batches (pipelining) is where the extra speed comes from.

Which plan

Redis needs RAM for your data and little else. Nano (2 vCPU, 1 GB, $3/mo) runs Redis next to a small app with maxmemory 256mb. Micro (2 GB, $5/mo) leaves room for a larger cache plus the app. If something else needs to connect to Redis directly, use your own IPv4 (from Nano-IP at $8/mo) and allow only that one address in the firewall. All plans are on the VPS page, and payment is in USDT, USDC or ETH on Base, Ethereum or Polygon.