Redis

In-memory database and cache. AGPL-3.0-only. linux/amd64.

Pin this image next to hardened Argo CD.

published Latest tag 8.6.4-alpine-tpio.1. Usage with Argo CD is on the Argo CD page.

Pin by digest

oci.thepeoples.io/hardened/redis@sha256:83b6e02798f8896d6eddd4f6c977a821ac4fe8a12d0bd886e1db9cb775114145

Pull:

podman pull oci.thepeoples.io/hardened/redis@sha256:83b6e02798f8896d6eddd4f6c977a821ac4fe8a12d0bd886e1db9cb775114145

Verify:

cosign verify --key https://thepeoples.io/keys/oci.thepeoples.io.pub --insecure-ignore-tlog oci.thepeoples.io/hardened/redis@sha256:83b6e02798f8896d6eddd4f6c977a821ac4fe8a12d0bd886e1db9cb775114145

Published 2026-10-09T14:38:21Z36.9 MiB compressed

Usage

These image overrides were exercised as part of the full argo/argo-cd 10.10.1 Helm HA install; see the Validated section. The redis_exporter sidecar is not hardened. The example pins the upstream image by digest and labels it in the values file. A proposal to add it to the hardened allowlist is recorded with the catalog change. Use the complete HA values for the full tested configuration.

global: {image: {repository: oci.thepeoples.io/hardened/argocd, tag: "v3.5.4-tpio.2@sha256:0f0d36559c94d41c544d65c6ead8bd2aa7f29a9d04d9721af9dd29c2558bc2d8"}}
dex: {image: {repository: oci.thepeoples.io/hardened/dex, tag: "v2.46.0-tpio.2@sha256:29991671646ac11153ba0225fc26b20b237ad432be56cbcaccb7b1e9635f4ba3"}}
redis: {image: {repository: oci.thepeoples.io/hardened/redis, tag: "8.6.4-alpine-tpio.1@sha256:83b6e02798f8896d6eddd4f6c977a821ac4fe8a12d0bd886e1db9cb775114145"}}
redis-ha:
  image: {repository: oci.thepeoples.io/hardened/redis, tag: "8.6.4-alpine-tpio.1@sha256:83b6e02798f8896d6eddd4f6c977a821ac4fe8a12d0bd886e1db9cb775114145"}
  haproxy: {image: {repository: oci.thepeoples.io/hardened/haproxy, tag: "3.3.16-alpine-tpio.1@sha256:ba110856a084d7a5b9d61325ef6a24928371b3a9b22a37270a53929c5a7c1e7e"}}

---
# HA variant: redis-ha (3x redis + sentinel) behind 3x haproxy; images come from build/validate/values-images.yaml
redis:
  enabled: false
redis-ha:
  enabled: true
controller:
  replicas: 1
server:
  replicas: 2
repoServer:
  replicas: 2
---
# Production-oriented Helm values exercised by validate/run.sh together with
# validate/values/ha.yaml and the generated image pins. CI-only overlays live
# in test-env.yaml / test-env-ha.yaml and are not part of the public example.
# Secrets stay placeholders. Turn a metrics block off by setting enabled: false.

# NetworkPolicy objects for every component (chart default is already true).
# https://argo-cd.readthedocs.io/en/stable/operator-manual/ingress/#network-policy
# https://kubernetes.io/docs/concepts/services-networking/network-policies/
global:
  networkPolicy:
    create: true
    defaultDenyIngress: false
  # Soft anti-affinity spreads replicas when the cluster has enough nodes.
  # https://argo-cd.readthedocs.io/en/stable/operator-manual/high_availability/
  affinity:
    podAntiAffinity: soft
  securityContext:
    runAsNonRoot: true
    seccompProfile:
      type: RuntimeDefault
  # https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
  logging:
    format: json
    level: info

# HA shape from the upstream chart README (without autoscaling).
# https://github.com/argoproj/argo-helm/tree/main/charts/argo-cd#ha-mode-without-autoscaling
# https://argo-cd.readthedocs.io/en/stable/operator-manual/high_availability/
controller:
  replicas: 1 # only one replica unless sharding is enabled
  # configs.params.controller.sharding.enabled / .replicas to shard clusters
  metrics:
    enabled: true # set false to skip the metrics Service
  pdb:
    enabled: true
    minAvailable: 1
  resources:
    requests: {cpu: 250m, memory: 256Mi}
    limits: {cpu: 1, memory: 1Gi}
  containerSecurityContext:
    runAsNonRoot: true
    readOnlyRootFilesystem: true
    allowPrivilegeEscalation: false
    capabilities: {drop: [ALL]}
    seccompProfile: {type: RuntimeDefault}

server:
  replicas: 2
  metrics:
    enabled: true # set false to skip the metrics Service
  pdb:
    enabled: true
    minAvailable: 1
  resources:
    requests: {cpu: 100m, memory: 128Mi}
    limits: {cpu: 500m, memory: 256Mi}
  containerSecurityContext:
    runAsNonRoot: true
    readOnlyRootFilesystem: true
    allowPrivilegeEscalation: false
    capabilities: {drop: [ALL]}
    seccompProfile: {type: RuntimeDefault}

repoServer:
  replicas: 2
  # Parallelism is per-pod; scale replicas before raising the limit.
  # https://argo-cd.readthedocs.io/en/stable/operator-manual/high_availability/#repo-server
  metrics:
    enabled: true # set false to skip the metrics Service
  pdb:
    enabled: true
    minAvailable: 1
  resources:
    requests: {cpu: 100m, memory: 128Mi}
    limits: {cpu: 1, memory: 1Gi}
  containerSecurityContext:
    runAsNonRoot: true
    readOnlyRootFilesystem: true
    allowPrivilegeEscalation: false
    capabilities: {drop: [ALL]}
    seccompProfile: {type: RuntimeDefault}

applicationSet:
  replicas: 2
  metrics:
    enabled: true # set false to skip the metrics Service
  pdb:
    enabled: true
    minAvailable: 1
  resources:
    requests: {cpu: 50m, memory: 64Mi}
    limits: {cpu: 250m, memory: 256Mi}
  containerSecurityContext:
    runAsNonRoot: true
    readOnlyRootFilesystem: true
    allowPrivilegeEscalation: false
    capabilities: {drop: [ALL]}
    seccompProfile: {type: RuntimeDefault}

# Dex telemetry is the metrics listener on container port 5558.
# https://dexidp.io/docs/getting-started/
# https://argo-cd.readthedocs.io/en/stable/operator-manual/metrics/
dex:
  metrics:
    enabled: true # set false to skip the Dex metrics Service
  pdb:
    enabled: true
    minAvailable: 1
  resources:
    requests: {cpu: 10m, memory: 32Mi}
    limits: {cpu: 100m, memory: 128Mi}
  containerSecurityContext:
    runAsNonRoot: true
    readOnlyRootFilesystem: true
    allowPrivilegeEscalation: false
    capabilities: {drop: [ALL]}
    seccompProfile: {type: RuntimeDefault}

configs:
  params:
    # 0 = unlimited per repo-server pod. Prefer more replicas over a huge limit.
    # https://argo-cd.readthedocs.io/en/stable/operator-manual/high_availability/#repo-server
    reposerver.parallelism.limit: "0"
    controller.status.processors: "20"
    controller.operation.processors: "10"

# redis-ha AUTH is on by default; replace the generated secret in production.
# https://github.com/DandyDeveloper/charts/tree/master/charts/redis-ha
# https://redis.io/docs/latest/operate/oss_and_stack/management/security/acl/
# https://redis.io/docs/latest/operate/oss_and_stack/management/persistence/
redis-ha:
  auth: true
  existingSecret: argocd-redis # placeholder; chart job fills this unless you bring your own
  persistentVolume:
    enabled: true
    storageClass: "" # cluster default StorageClass
    size: 8Gi
  exporter:
    enabled: true # set false to skip the redis_exporter sidecar
    # NOT HARDENED: redis_exporter is not on the hardened allowlist yet.
    # Upstream image pinned by digest from oliver006/redis_exporter v1.93.0
    # (multi-arch index; linux/amd64 manifest sha256:eb2b1e93b654fc21bf508e45ec3d17ca55d22db66c6b826750cecc92c0c21e42).
    image: ghcr.io/oliver006/redis_exporter
    tag: "v1.93.0@sha256:6ca518a72f30f7f576ef92963de1b91d3c3f5fd3aeac949f878bfda183587820"
  haproxy:
    metrics:
      enabled: true # set false to skip HAProxy Prometheus metrics
    containerSecurityContext:
      readOnlyRootFilesystem: true
      allowPrivilegeEscalation: false
      capabilities: {drop: [ALL]}
      seccompProfile: {type: RuntimeDefault}
    # https://www.haproxy.org/download/3.3/doc/management.txt
    resources:
      requests: {cpu: 50m, memory: 64Mi}
      limits: {cpu: 250m, memory: 128Mi}

Standalone example, not validated

The command also works with podman in place of docker.

Redis listens on port 6379 and persists data under /data. This example enables AOF persistence. The upstream image does not configure authentication from a REDIS_PASSWORD environment variable; set ACLs/passwords in a mounted redis.conf when needed.

docker run --rm -p 127.0.0.1:6379:6379 -v redis-data:/data \
  oci.thepeoples.io/hardened/redis@sha256:83b6e02798f8896d6eddd4f6c977a821ac4fe8a12d0bd886e1db9cb775114145 redis-server --appendonly yes

Verify the latest published digest

cosign verify --key https://thepeoples.io/keys/oci.thepeoples.io.pub --insecure-ignore-tlog oci.thepeoples.io/hardened/redis@sha256:83b6e02798f8896d6eddd4f6c977a821ac4fe8a12d0bd886e1db9cb775114145
cosign verify-attestation --key https://thepeoples.io/keys/oci.thepeoples.io.pub --insecure-ignore-tlog --type https://thepeoples.io/attestations/hardened-gate/v1 oci.thepeoples.io/hardened/redis@sha256:83b6e02798f8896d6eddd4f6c977a821ac4fe8a12d0bd886e1db9cb775114145

The report views show the predicate types and commands for SPDX, scanner and optional OpenVEX attestations. Inspect the verified predicates as well as the signature.

This image is here as the HA cache. Used by Argo CD (HA cache).

Status: published. Platform: linux/amd64.

Available tags and scan history

oci.thepeoples.io/hardened/redis@sha256:83b6e02798f8896d6eddd4f6c977a821ac4fe8a12d0bd886e1db9cb775114145

Rebuild and licence

Same upstream digest plus an apk upgrade layer (ladder c).

Licence: AGPL-3.0-only.

Redis 8.x is offered under RSALv2, SSPLv1 or AGPLv3. thepeoples.io redistributes this image under AGPLv3 only. The Redis source is unmodified. Corresponding-source archives, exact packaging, SHA-256 sums and our rebuild recipe are listed for each published tag.

Upstream source