The Valkey and Redis Split: Life After the License Fight

说明与用途

许多生产系统使用受SSPL/RSAL约束的旧版Redis 7.x镜像，缺少关键安全补丁。通过审计容器镜像，升级到Redis 8（AGPLv3）或Valkey（BSD‑3），并调整操作系统包和监控，可降低法律和安全风险。

问题

Many production systems unknowingly run outdated Redis 7.x images under SSPL/RSAL licenses, exposing them to unpatched security vulnerabilities and licensing risks.

结果

By auditing container images, updating to the latest Redis 8 or Valkey releases, and aligning system packages and monitoring, the author mitigated licensing exposure and applied critical security patches, ensuring compliance and operational integrity.

工作流

• 1. Run docker ps and inspect running images. 2. Verify image tags and pull dates. 3. Check redis-server --version and INFO server for license and version. 4. Identify unpatched security releases via Redis release notes. 5. Decide on target engine (Redis 8 or Valkey). 6. Update Dockerfiles or compose files to use the chosen image tag. 7. Pull the new image and redeploy containers. 8. Update system package managers (apt, dnf) to install the appropriate package (redis-server or valkey-server). 9. Adjust configuration paths, service units, and backup scripts to match the new package. 10. Update monitoring dashboards to read the correct redis_version or valkey_version fields. 11. Verify that security patches are applied and no license violations remain.

证据

The 7.4 series is distributed under RSALv2 or SSPLv1, so the "return to open source" that AGPLv3 delivered covers neither machine.

来源

The release notes for Redis 7.4.11 mark its urgency as SECURITY and close, among other things, an ACL key-permission bypass in SORT and XREAD.

来源

Debian trixie ships both packages: redis-server 5:8.0.2 and valkey-server 8.1.1.

来源