Catalog / Databases & caches

Valkey

Redis-compatible in-memory data store under the Linux Foundation

CIS Level 1 hardened Ubuntu 24.04 LTS image by Lynxroute · unique credentials at first boot · CVE-scanned · SBOM and CIS report inside

AWS Marketplace9.1.2↗ Azure Marketplace9.1.2↗ Alibaba Marketplace9.1.1↗
Availability and pricing
CloudVersionSoftware priceLast build
AWS Marketplace
EC2 AMI · all commercial regions
9.1.2$0.03/hr
Recommended instance: t3.small · 5-day free trial
2026-09-01Listing ↗
Azure Marketplace
VM image · plan payg-gen2 · Gen2
9.1.2$0.028/vCPU/hr
Recommended VM: Standard_D2s_v3
2026-09-02Listing ↗
Alibaba Cloud Marketplace
ECS image · ap-southeast-1 (Singapore)
9.1.1$0.028/vCPU/hr
Recommended instance: ecs.e-c1m2.large
2026-08-13Listing ↗

Software price only; cloud infrastructure is billed separately by the provider. Prices in USD.

Image facts
Base OSUbuntu 24.04 LTS
HardeningCIS Level 1, Ubuntu 24.04 LTS (tailored)
LicenseBSD-3-Clause
UpstreamLinux Foundation
Machine-readableproduct.json · catalog.json
What is Valkey

Valkey is the open-source, high-performance Redis-compatible in-memory data store maintained by the Linux Foundation - forked from Redis OSS 7.2 in 2024 when Redis Inc. relicensed to BSL. It supports the full Redis API including strings, hashes, lists, sets, sorted sets, streams, pub/sub messaging, Lua scripting, transactions, geospatial commands, hyperloglog, bitmaps and the modules ecosystem. Operators get RDB snapshots and AOF persistence to local disk, replica replication and cluster sharding for horizontal scale. Drop-in compatible with all existing Redis clients across Java, Python, Node.js, Go, PHP, Ruby and 100+ other languages and frameworks - no application code changes required. BSD-3-Clause license - the safe vendor-neutral path forward for self-hosted Redis users.

What the Lynxroute image adds

Security hardening:

  • Strong random password at first boot - no default or empty password
  • Binds to 127.0.0.1 only - not exposed to the network by default
  • FLUSHALL and FLUSHDB disabled
  • UFW firewall - port 6379 blocked externally, SSH on 22 only
  • fail2ban, AppArmor

OS hardening (CIS Level 1):

  • CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown
  • auditd, SSH hardening, Kernel hardening, IMDSv2 enforced

Compliance artifacts:

  • SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
  • CIS Conformance Report at /etc/lynxroute/cis-report.html
  • CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md
Deploy

Launch in one command

Credentials are generated at first boot and written to /root/valkey-credentials.txt.

# subscribe once on the AWS Marketplace listing, then:
aws ec2 run-instances \
  --image-id resolve:ssm:/aws/service/marketplace/prod-bk3sq2xsmcxsc/latest \
  --instance-type t3.small --key-name my-key --security-group-ids sg-xxxxxxxx
# accept the plan terms once, then:
az vm image terms accept --publisher lynxroute --offer valkey --plan payg-gen2
az vm create -g my-rg -n valkey --size Standard_D2s_v3 \
  --image lynxroute:valkey:payg-gen2:latest --admin-username azureuser --generate-ssh-keys
# launch from the Marketplace listing in the console:
Marketplace listing -> Buy Now -> region ap-southeast-1 -> instance type ecs.e-c1m2.large -> create ECS instance
# image id in ap-southeast-1: m-t4nhvsbqa53o37xeth7a
Release notes

Latest release

The most recent release with notes; the full release history is in product.json.

Valkey 9.1.2

AWS · 2026-09-01Azure · 2026-09-02
  • Valkey 9.1.2 on Ubuntu 24.04 LTS - security update from 9.1.1. BSD-3-Clause unchanged
  • Fixes GHSA-fq2f-crmw-q97r: an unauthenticated use-after-free of the Lua interpreter state, caused by a process-global script debugger command table that cached a pointer to a freed interpreter and was never invalidated
  • Fixes GHSA-jcj7-v34w-v9vv: a use-after-free in RDMA connection handling reachable through CLIENT KILL. This build has no RDMA listener and was not exposed to it
  • Closes several ACL gaps: HGETEX now requires write permission on the key, duplicate STORE options can no longer let GEORADIUS write outside permitted key patterns, MOVE and COPY check access to the destination database, and a NUL embedded in a TLS certificate CN can no longer impersonate another user
  • Hardens loading of untrusted data: listpacks are always validated on RDB load and RESTORE, and stream, cluster-bus and slot-import payloads are validated against crafted input
  • Fixes a permanent client deadlock when a blocking command is followed by a partially delivered pipelined command, a frozen monotonic clock on hosts with an unsynchronized TSC that stopped key expiration, a stack overflow when retrying a large TLS write, and AOF loss of newer writes after a short read in a MULTI block
  • Root volume increased from 8 GB to 10 GB for headroom above the hardened base
  • Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base