·
Last changedVersion:
This version passed the hardening gate. Hardening applied 11 targeted changes and preserved all other text. Classified findings before hardening: 0. Classified findings closed: 0. Classified findings remaining: 0. Unclassified scanner findings remaining: 0. Review findings closed: 7. Review findings remaining: 1.
None
None
Expand | File | Group | Subtype | Severity | Status |
|---|
No findings available
0 findings
Client-side guidance for talking to Redis efficiently: how to share connections, how to batch commands, which commands not to call in production, when to turn on client-side caching, and how to set timeouts that fail fast without breaking healthy traffic.
The single biggest mistake in Redis client code is opening a new TCP connection for every operation. Always either:
ConnectionPool, Jedis JedisPooled, go-redis client).| Style | Used by | Note |
|---|---|---|
Pool | redis-py, Jedis, go-redis | Each lease blocks if pool exhausted; size the pool to your concurrency |
Multiplex | Lettuce, NRedisStack | Single connection; cannot carry blocking commands like |
Set a bounded wait timeout for leasing a pooled connection, so callers fail fast instead of hanging when the pool is exhausted.
These examples connect to a local development server. In production, enable authentication and TLS with certificate verification, and load the username and password from the environment or a secret store rather than source code.
See references/pooling.md for Python + Java + Lettuce examples.
For N commands that don't depend on each other's results, send them as a single batch with pipelining. One round-trip instead of N. In these snippets redis stands for a client instance, such as r from section 1, not the module.
Use non-transactional pipelining for performance, and pipeline(transaction=True) only when you actually need atomicity (see redis-core's transactions guidance).
Anything that walks the whole keyspace (or a whole large container) blocks the server. Use incremental variants instead.
| Don't | Use |
|---|---|
|
|
|
|
|
|
| Paginate ( |
Blocking commands (BLPOP, BRPOP, BLMOVE) are different — they intentionally wait for data and are fine for queue consumers, but always pass a timeout, and don't issue them on a multiplexed connection (Lettuce, NRedisStack).
For data that's read often and written rarely (config, feature flags), enable RESP3 client-side caching. The client keeps a local copy and the server invalidates it on writes — saving the round trip for hot reads.
Client-side caching needs a redis-py release that supports it, protocol 3, and a Redis server with RESP3 client tracking; check where your client version exports the cache config class. Keep session, authentication and revocation state out of the local cache, since it changes often and must stay current after a missed invalidation or reconnect.
Skip it for write-heavy workloads or data that changes constantly — the invalidation traffic overruns the savings.
See references/client-cache.md.
Defaults vary by client and may be too generous. Pick values that match the application's failure model:
Rule of thumb: connect timeout shorter than read/write timeout. Tight timeouts + retry-on-timeout for latency-sensitive paths; longer timeouts for batch jobs.
Use retry on timeout only for commands that are safe to repeat, such as reads. A timed out write may already have been applied, so for counters, list pushes and other writes that are not idempotent, turn retries off or use transactions. Newer redis-py versions favor an explicit retry policy with backoff over the simple flag; check your client version. These timeout examples also target a local server; apply the same production authentication and TLS settings described in section 1.
Get started with chainctlchainctl skill install public/redis/redis-connections:latest
Bring Chainguard's hardening pipeline to your first-party skills — custom rulesets, automated remediation, full audit trail.
skills.cgr.dev/public/github.com/redis/skills/redis-connections:latest
MIT
HARDENING.md
LICENSE
SKILL.md
references/blocking.md
references/client-cache.md
references/pipelining.md
references/pooling.md
references/timeouts.md