Add disable persistence option #1746
Closed
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
mattsta
force-pushed
the
nopersist
branch
2 times, most recently
from
5425f76
to
f07513d
Compare
Config option "disable-all-persistence" stops Redis from writing or reading an AOF or RDB. If you are on Linux and are running with the proper permissions (a "ulimit -l" of 'unlimited', typically only settable by root, or the CAP_IPC_LOCK capability), this option also disables the paging of any Redis memory to disk. Config option "disable-replication" stops Redis from becoming a master or replica or migrating keys to other nodes or participating in a cluster. disable-all-persistence automatically enables disable-replication. disable-all-persisitence also stops Redis from creating any background-I/O threads since they would have zero work to do anyway. You *can* use disable-replication independently if you want to store data to disk but turn off all network replication/clustering/migration. These options can only be set at launch. You cannot alter these settings after Redis starts. Once your server is running with any of these isolation guarantees, it will remain isolated. These options are designed to create isolated and "pure" Redis instances for data that must never leave Redis except by direct client access. Of course, someone could always just scan your entire database from a client and copy it that way, but it's still not a live replication channel. Without these options, it can be tricky to track down every "disable storage" option. Without the "disable-replication" option, there isn't any way to stop Redis from replicating over the network except using firewalls/ACLs.
|
+1 |
|
This feature is also mandatory if you use a MASTER/SLAVE as a cache backend. If all servers are rebooted, the master will reload an old dump.rdb file which was created (as I understand it) for an inital master/slave sync (even in diskless mode), hence reverting the cache to an old state and breaking the application. The only solution I found it to delete any rdb files in my startup script. |
|
This is mostly obsolete now, mainly as diskless replication has been around for some time now and other persistence options are tunable anyway. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This is a first attempt at fixing issue #1704.
Some security applications require the ability to disable all disk persistence. Redis makes globally disabling persistence difficult since multiple places enable/disable persistence and persistence can always be manipulated by
CONFIG SETduring runtime. This commit removes the ability to enable persistence after the server starts.New configuration options (can be set at start only, no live changes):
disable-replication- removesSYNC,PSYNC,SLAVEOF,MIGRATE,CLUSTER,REPLCONFcommands.disable-all-persistence- removesSAVE,BGSAVE,BGREWRITEAOFcommands. Disables reading AOF or RDB on startup. DisablesCONFIG REWRITEso people can't try to change configuration options to hold data then save it to disk. DisablesSHUTDOWN SAVE. Avoids spawning the background I/O threads.disable-all-persistenceautomatically enablesdisable-replicationbecause a.) we don't want replicas to persist our data and b.) replication requires serializing the DB to disk to send to the replica.disable-replicationautomatically setscluster-enabledtono.If you're on Linux,
disable-all-persistencealso attempts to lock all memory into RAM to stop anything from entering your swap space. That can only happen if you either run as root or have explicit capabilityCAP_IPC_LOCK.The implementation is very paranoid. It disables commands then, in the commands themselves, each potential write command aborts if nopersist is set, then in the functions performing writes or network connections, the function immediately returns if nopersist (or noreplication) is set.
The reason for the multi-layered approach is: some operations (like saving an RDB) have multiple entry points (
SAVE,BGSAVE, thesaveconfig option,SHUTDOWN SAVE, ...) and I wanted to make sure, even if we miss disabling an entry point, that write functions are still disabled. Multi-layered blocks will make security audit people happier too.