I received an warning email from DO stating my redis instance isnt secure and is accessible by any outsider

Hi there,

The most straightforward way of securing your instance without making any configuration changes would be to use a firewall. You could use a Cloud Firewall at no additional cost and just close down the Redis port:

https://docs.digitalocean.com/products/networking/firewalls/

If you don’t want to use a firewall there are a couple of other things that you could do but those would require some changes to the existing running container.

Given that you’re running Redis inside a Docker container, the security configuration differs slightly from a Redis instance installed directly on the host.

If your Redis container and other application containers (e.g., backend, pgadmin) are on the same Docker network, they can communicate with each other without exposing Redis to the outside world. So before making any of the following changes, make sure that your containers are in the same network.

Once that is done, here’s how you can secure your Redis container:

1. Bind Redis to Localhost Inside the Container:

   Redis’ default configuration binds to all available network interfaces (0.0.0.0). You should change this so that Redis only binds to localhost (127.0.0.1) inside the container. This ensures that Redis can only be accessed from within the container itself.

   Modify your Docker run command or Docker Compose file to include the Redis configuration binding:

   • Using docker run:

     docker run ... redis redis-server --bind 127.0.0.1
     

   • Using docker-compose.yml:

     services:
       redis:
         image: redis
         command: redis-server --requirepass yourpassword
         ...
     

2. Remove Ports Exposed to Host:

   If you’ve exposed Redis ports to the host (i.e., you’ve mapped them using -p with docker run or the ports directive in docker-compose.yml), you should remove this to prevent external access.

   If using docker-compose.yml, change:

   ports: - "6379:6379"
   

   to:

   expose: - "6379"
   

   The expose directive ensures that the port is available only to other containers in the same Docker network and not to the host or the outside world.

Hope that this helps!

Best,

Bobby