The supported way to self-host Redis Insight is to run Redis’s official redis/redisinsight:latest Docker image on your VPS. Publish port 5540, mount a persistent volume at /data, keep that port private when possible, and place a TLS-terminating reverse proxy with authentication in front of it.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
For a quick persistent deployment, run:
docker run -d --name redisinsight
-p 5540:5540
-v redisinsight:/data
redis/redisinsight:latestThe rest of this guide shows how to deploy the container safely, preserve connections and Workbench data across upgrades, expose it over HTTPS, monitor its health, and recover from common failures.
As an Amazon Associate I earn from qualifying purchases.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What you are self-hosting
Redis Insight is a web application for administering and working with Redis databases. A VPS gives you a continuously running Linux host, while Docker supplies the isolated application container. Your browser connects to Redis Insight; Redis Insight then connects to the Redis databases you configure.
The verified Docker image can be used with Redis Open Source, Redis Stack, Redis Enterprise Software, Redis Enterprise Cloud, and Amazon ElastiCache. It is therefore suitable for a personal administration server, a team operations box, or a private tool reachable through a company network.
#1 Best Overall
The container listens on port 5540 by default. The application also keeps sensitive information, including database passwords and Workbench history, locally in SQLite. That makes storage protection, backups, and the encryption key operational requirements rather than optional conveniences.
Plan the VPS before installing
Host requirements
- A supported Linux VPS with enough CPU, memory, and disk for Docker and your Redis Insight workload.
- Docker installed according to the current instructions for the VPS distribution.
- Firewall controls so port 5540 can remain internal when a reverse proxy is used.
- Regular backups of the Docker volume that contains Redis Insight’s
/datadirectory. - A DNS name and TLS certificate if users will access the interface from the public internet.
Redis Insight is not the Redis server itself. If your Redis databases are on other hosts, make sure the VPS can route to them and that those databases accept connections from the VPS’s address. Restrict database firewall rules to the smallest source range practical.
Choose how users will reach it
| Deployment method | Public attack surface | TLS and authentication | Long-running requests | Operations and recovery |
|---|---|---|---|---|
| Direct host port | Port 5540 is exposed directly; every scanner on the internet can reach the application. | You must secure the application or host separately; there is no proxy layer to centralize policy. | No proxy timeout to tune. | Simplest to start, but firewalling, certificates, and access control are your responsibility. |
| Reverse proxy | Only the proxy’s HTTPS port needs to be public; 5540 can stay bound to localhost. | The proxy terminates TLS and can enforce basic authentication or another access-control layer. | Configure a read/request timeout above 30 seconds, as Redis documents long-running requests. | More configuration, but a clean place for certificates, logs, authentication, and health checks. |
| Private VPN or tunnel | The interface is reachable only through the private network or tunnel. | Access is controlled by network membership; HTTPS may still be appropriate for defense in depth. | The tunnel must pass requests for longer than 30 seconds without disconnecting them. | Smallest internet exposure, but every administrator needs reliable private-network access. |
For an internet-accessible VPS, the reverse-proxy design is the usual balance: bind Redis Insight to the VPS itself, publish only HTTPS, and require authentication before forwarding requests.
Install Docker and start Redis Insight
1. Install Docker on the VPS
Connect to the VPS over SSH and install Docker using the host distribution’s current documentation. Do not assume that a package named docker is the newest supported engine on every distribution. Confirm that the daemon is running and that your administrative account can execute docker ps.
2. Create a persistent container
The official minimal command is:
docker run -d --name redisinsight
-p 5540:5540
-v redisinsight:/data
redis/redisinsight:latestThis creates a named Docker volume called redisinsight and mounts it at the location Redis Insight uses for its local data. Removing and recreating the container will not remove that named volume unless you explicitly delete the volume.
If a reverse proxy will run on the same VPS, bind the host port only to the loopback interface:
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →docker run -d --name redisinsight
--restart unless-stopped
-p 127.0.0.1:5540:5540
-v redisinsight:/data
redis/redisinsight:latestThe application still listens on 0.0.0.0 inside the container by default, but the host-side binding prevents direct remote access to port 5540. If you intentionally need another private interface, bind that address instead and keep the VPS firewall aligned with the design.
3. Verify that the container is running
- Run
docker psand confirm thatredisinsighthas an up status and a port mapping for 5540. - Inspect startup output with
docker logs redisinsightif the container exits or repeatedly restarts. - From the VPS itself, request
http://localhost:5540/api/health/. A successful response confirms that the application process is answering locally. - Open the web interface through the address you selected. If port 5540 is bound to localhost, test through the reverse proxy rather than a direct public URL.
Redis documents /api/health/ as the container health-check endpoint. Keep it on an internal or authenticated monitoring path instead of exposing an unauthenticated health endpoint to the public internet.
Rank #2
Make data, credentials, and encryption survive recreation
Use the same volume every time
The /data mount is where Redis Insight keeps its local SQLite data, including saved connection information and Workbench history. A common upgrade mistake is to recreate the container without -v redisinsight:/data; the new container then starts with an empty data directory.
Before changing anything, record the volume name and inspect it with Docker’s volume commands. Your replacement container must mount the same volume at exactly /data. Do not mount a new volume merely because its name is similar.
Free tools Windows power users keep installed
One-click scans. No signup required.
Fix a volume permission error
If Docker reports that the application cannot write to the mounted volume, Redis states that the user with ID 1000 must have access to that volume. Check the ownership and permissions of the volume data, then adjust them using an administrative maintenance container or the host’s Docker volume path. Make the change while Redis Insight is stopped so that files are not modified concurrently.
Do not solve the problem by making the entire volume world-writable. Grant the UID 1000 account the access it needs and keep the host’s Docker storage protected from ordinary users.
Set and retain an encryption key
Set RI_ENCRYPTION_KEY when you deploy the container and retain the identical value for every later start that reuses the volume. Redis Insight stores sensitive values locally, so the key belongs in the same protected secret-management process as your other administrative credentials.
For example, place the value in a root-readable environment file rather than typing it repeatedly in shell history:
RI_ENCRYPTION_KEY=replace-with-a-long-random-secretStart the container with --env-file while preserving the volume mount:
docker run -d --name redisinsight
--restart unless-stopped
-p 127.0.0.1:5540:5540
--env-file ./redisinsight.env
-v redisinsight:/data
redis/redisinsight:latestKeep the environment file out of source-control repositories and restrict its permissions on the VPS. When restoring a volume, supply the same encryption key before starting the restored container.
Back up the volume
Back up the complete contents of the named volume, not just a list of connection names. A portable Docker-based example is:
docker run --rm
-v redisinsight:/data:ro
-v "$PWD":/backup
alpine tar czf /backup/redisinsight-data.tgz -C /data .Store the archive somewhere separate from the VPS and protect it as confidential data because it may contain database passwords and usage history. Test restoration on a temporary volume: extract the archive, start a replacement container with the restored volume and the retained RI_ENCRYPTION_KEY, and verify that saved connections and Workbench history are present.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsUpgrade without losing settings
- Back up the
redisinsightvolume and preserve the encryption key. - Pull the current image with
docker pull redis/redisinsight:latest. - Stop and remove the old container:
docker stop redisinsight, thendocker rm redisinsight. Removing the container does not remove the named volume. - Recreate the container with the same port binding, the same
redisinsight:/datamount, and the same environment file. - Check
docker logs redisinsight, request the health endpoint, and sign in through the proxy before declaring the upgrade complete.
The latest tag follows the current official image. Treat an image update as a change: back up first, update during a maintenance window, and retain the previous recovery archive.
Expose Redis Insight safely through HTTPS
Run a reverse proxy on the VPS
Install NGINX or another reverse proxy on the host, obtain a certificate for the chosen DNS name, and terminate TLS at that proxy. Forward requests to http://127.0.0.1:5540; do not publish the container port separately in the VPS firewall.
An NGINX server block needs to preserve the original host and forwarding information and allow requests to run longer than 30 seconds. The following is an illustrative location block; add your certificate directives and distribution-specific file paths:
location / {
proxy_pass http://127.0.0.1:5540;
proxy_http_version 1.1;
proxy_read_timeout 60s;
proxy_send_timeout 60s;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}Redis specifically documents the need for a proxy read/request timeout above 30 seconds because some operations are long-running. A 60-second value gives ordinary requests room to complete; choose a longer value if your workload requires it and ensure any upstream load balancer uses a compatible timeout.
Add authentication at the proxy
Do not rely on an obscure URL as authentication. Add basic authentication in NGINX or use an equivalent access-control layer, and use a strong, unique password. Basic authentication must be used over HTTPS so credentials are encrypted in transit.
With NGINX, the relevant directives are placed in the same protected location:
auth_basic "Redis Insight";
auth_basic_user_file /etc/nginx/.htpasswd;Create the password file with the htpasswd utility supplied by your Linux distribution, test the NGINX configuration, and reload NGINX. Protect the password file itself and restrict who can log in to the administrative interface.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Use a subpath only when you need one
If the application must appear below a URL prefix such as /redisinsight, set RI_PROXY_PATH to that prefix and configure the proxy without path rewriting. Redis states that hosting behind a prefix through path-rewriting is unsupported. Once a static subpath is configured, the default root endpoint will not work.
For a root deployment, leave RI_PROXY_PATH unset and proxy / directly to port 5540. Root hosting is less error-prone because browser assets and API requests use their default paths.
Configure application settings and database connections
Important environment settings
| Setting | Purpose and default | Operational note |
|---|---|---|
RI_APP_PORT |
Application port; Docker defaults to 5540. | If you change it, update the container port mapping and proxy upstream together. |
RI_APP_HOST |
Listen address; Docker defaults to 0.0.0.0. |
Host-side port binding and firewall rules still determine remote exposure. |
RI_PROXY_PATH |
Static URL prefix for a proxy subpath. | Do not combine it with path rewriting; the default endpoint is unavailable after a prefix is configured. |
RI_ENCRYPTION_KEY |
Key used while sensitive local data is stored. | Keep the same value for future starts using the same /data volume. |
| TLS key and certificate variables | Options for configuring TLS in the application itself. | When TLS is terminated by NGINX, keep certificate lifecycle and renewal at the proxy unless you have a specific reason to terminate twice. |
The image also documents variables for logging, database preconfiguration, and database-management controls. Changes to these settings take effect after the container restarts.
Preconfigure connections
Redis Insight supports supplying database connections through environment variables or a JSON file compatible with its export format. This is useful when every new container must start with the same approved endpoints, but the configuration file and environment values should be treated as secrets when they include credentials.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteAfter changing a preconfiguration value, restart the container and check the interface again. A running process will not necessarily reload connection definitions automatically.
Connect to remote Redis services
For each connection, verify the hostname or private address, port, authentication method, and network route from the VPS. A successful Redis Insight page does not prove that the VPS can reach a database in another network. Check outbound firewall rules and the database’s allow-list separately, and avoid exposing a Redis service directly to the public internet simply to make the connection work.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Monitor and operate the deployment
Health checks
Use http://localhost:5540/api/health/ for a local probe. A monitoring system can call the same endpoint through an authenticated proxy path, or you can keep the check on the VPS and alert on a failed local response. Record both the HTTP result and whether the Docker container is restarting.
Best Value
Logs and lifecycle commands
docker psshows whether the container is running and how the port is mapped.docker logs --tail 200 redisinsightdisplays recent startup and application messages.docker restart redisinsightrestarts the process without changing its volume.docker inspect redisinsighthelps confirm mounts, environment settings, and restart policy.
Keep proxy logs as well as container logs. A 401 response indicates an authentication problem at the proxy; a 502 or 504 usually points to an upstream, container, or timeout problem; a healthy local endpoint with an unreachable public URL points toward DNS, TLS, firewall, or proxy configuration.
Recommended Free Tools
Troubleshoot the common failures
The browser cannot open Redis Insight
- Run
docker psand verify that the container is up. - Request
http://localhost:5540/api/health/on the VPS. - If the local request fails, inspect
docker logs redisinsightand check the port mapping. - If the local request succeeds, check DNS, the TLS virtual host, the proxy upstream address, and the VPS firewall.
- If port 5540 is bound to
127.0.0.1, do not test it from another machine; use the HTTPS proxy.
Settings or connections disappeared after an upgrade
Confirm that the replacement container mounts redisinsight:/data and that you did not accidentally create a new volume. Check that the encryption key is identical to the value used with the previous volume. If the original volume still exists, stop the replacement container, restore the original mount and key, and test again.
Docker reports a permission error on /data
Ensure the UID 1000 user can read and write the mounted data. Correct ownership while the container is stopped, then start it again. Avoid deleting the volume as a first response; deletion removes the local connection database and history.
The proxy returns a timeout
Raise the proxy read and request timeout above 30 seconds, then reload the proxy. Check whether an outer firewall, load balancer, or tunnel has a shorter idle timeout. Redis Insight can be healthy locally while an intermediate proxy still terminates a long-running request.
A subpath returns 404 or broken assets
Verify whether RI_PROXY_PATH is set. If it is, use the exact configured prefix and stop rewriting the path in NGINX. If you do not require a prefix, remove the variable, recreate or restart the container, and proxy the root path instead.
Preconfigured databases do not appear
Check the environment variable or JSON file syntax, confirm that the file is mounted where the container can read it, and restart Redis Insight. The documented preconfiguration changes apply after restart rather than through a live reload.
Security and recovery checklist
- Keep port 5540 private to the VPS whenever a reverse proxy or private tunnel is available.
- Terminate HTTPS at the proxy and renew certificates before they expire.
- Require authentication at the proxy or an equivalent access-control layer.
- Use a strong
RI_ENCRYPTION_KEY, retain it securely, and supply it unchanged after recreation. - Protect the
/datavolume and every backup archive as sensitive administrative data. - Back up the volume before image upgrades and test restoring it on a temporary container.
- Limit outbound access from the VPS to the Redis networks and inbound access to the proxy and administration channels.
- Monitor
/api/health/, container restarts, and proxy errors. - Document the volume name, environment file location, proxy configuration, certificate renewal method, and recovery procedure.
What this deployment does and does not provide
Self-hosting gives you control over the VPS location, network path, proxy policy, backups, and upgrade schedule. It does not automatically secure the web interface, encrypt backups, create Redis database backups, or repair an unreachable Redis service. Those responsibilities remain with the VPS and database operator.
The Redis Insight repository documents a Docker API at /api/docs, plugin support, and SSPL licensing. If you redistribute or modify the software as part of a larger service, review the applicable license obligations rather than assuming that running the official image removes them.
Recommended production layout
For most VPS installations, run Redis Insight with a named redisinsight volume, bind host port 5540 to localhost, and pass RI_ENCRYPTION_KEY through a protected environment file. Put NGINX on the public HTTPS port, require authentication, preserve the request path, and set a timeout comfortably above 30 seconds. Monitor the local health endpoint, back up /data, and recreate the container with the same volume and key whenever the image is updated.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
