This week in caching: hardening a Redis cache box before prod

This week in caching: hardening a Redis cache box before prod

A pre-flight checklist so your cache layer doesn't become an incident. Skip if you're on a managed service.

— Pick the right eviction policy — a pure cache wants allkeys-lru or allkeys-lfu; the default noeviction turns a full cache into write errors across your app.
— Set maxmemory explicitly — unset, Redis eats RAM until the OOM killer takes it down at peak.
— Disable dangerous commands — rename or block FLUSHALL, KEYS, and CONFIG in production; one stray KEYS * blocks the whole server.
— Bind and auth — never expose 6379 to the internet; set requirepass and bind to private interfaces. Open Redis boxes get cryptomined within hours.
— Watch evicted_keys and used_memory — rising evictions mean your working set outgrew memory; scale before the hit ratio collapses.

Credit to the Redis admin and security docs for the rename-command hardening.

Bookmark: the Redis 'Securing Redis' page — the eviction + auth defaults everyone should change.