How Do I Run Redis Stack and Redis Insight in a Cloud Sandbox?
Updated October 27, 2026 .md
Short answer: Redis 8 replaces Redis Stack, so run the official redis:8 image in a Sandboxer microVM with AOF on and --restart unless-stopped. JSON, search and vector sets are built in. Put Redis Insight on a private sbx host URL with --localhost, and reach Redis from your laptop with redis-cli over ssh -L. Data survived stop and resume.
What we ran#
Everything below ran on a default sandbox (4 vCPU, 8 GB) on 2026-10-27. Sandbox ids and tokens are replaced with $id and <token>.
| Check | Result |
|---|---|
| Image | redis:8 (Redis 8.10.3), modules search, ReJSON, vectorset, timeseries, bf loaded |
| Redis Insight | redis/redisinsight:latest (3.8.0), healthy 5 s after docker run |
redis-benchmark -q, inside the VM |
SET 75,245 req/s, GET 86,059 req/s; with -P 16, GET 990,099 req/s |
redis-cli --latency, inside the VM |
about 0.14 ms average |
redis-cli --latency from our machine over ssh -L |
127 ms average, 124 ms minimum |
| Private Insight URL | 401 without the token, 302 with it, then 200 with the cookie |
sbx stop --wait, then sbx resume |
memoryRestored: true, every key, index and the Insight URL still there |
systemctl restart docker (what a boot from disk looks like) |
Both containers came back on their own, data reloaded from the AOF |
Redis Stack or redis:8?#
The Redis docs now say that Redis 8 in Redis Open Source replaces Redis Stack, and the Docker install page uses the redis:<version> image. The JSON, search and vector features that used to need Redis Stack ship inside redis:8. Redis Insight, which the old Stack image bundled, is now its own image, redis/redisinsight. So this guide runs two containers.
1. Start Redis with AOF and a restart policy#
Docker is preinstalled in every sandbox (see Docker and nested KVM inside a sandbox).
sbx new --type default --name redis-stack-1
id=sb_xxxxxxxxxx # the id it printed
sbx exec $id "docker network create redis-net && docker volume create redis-data && \
docker run -d --name redis --network redis-net --restart unless-stopped \
-p 127.0.0.1:6379:6379 -v redis-data:/data \
redis:8 redis-server --appendonly yes --appendfsync everysec"Two choices matter here:
127.0.0.1:6379, not6379. Redis has no password by default. Every sandbox has a public IPv6 address. Its firewall (ufw) is closed except SSH (Security), but Docker can bypass ufw rules on some setups. Binding to loopback keeps Redis off the network whatever the firewall does. You reach it over SSH instead.--appendonly yes. Redis writes every change to an append-only file in theredis-datavolume and fsyncs once a second, so a restart loses at most about a second of writes.
Check it:
sbx exec $id "docker exec redis redis-cli INFO server | grep redis_version; \
docker exec redis redis-cli MODULE LIST; docker exec redis redis-cli CONFIG GET appendonly"redis_version:8.10.3
name
search
ver
81001
path
/usr/local/lib/redis/modules//redisearch.so
…
name
vectorset
…
name
ReJSON
…
appendonly
yesThe module list also shows bf (Bloom and other probabilistic types) and timeseries.
2. Strings, a JSON document, search and a vector query#
Save this as demo.sh, copy it in with sbx scp demo.sh $id:/home/user/ and run sbx exec $id "bash demo.sh". It calls redis-cli inside the container, one command per line.
r() { docker exec redis redis-cli "$@"; }
r SET greeting "hello from the sandbox"
r GET greeting
r JSON.SET doc:1 '$' '{"title":"Pause a sandbox","tags":["stop","resume"],"views":12}'
r JSON.NUMINCRBY doc:1 '$.views' 1
r JSON.GET doc:1 '$.title' '$.views'
r JSON.SET doc:2 '$' '{"title":"Fork a sandbox","tags":["fork"],"views":40}'
# Index the JSON documents, then query them
r FT.CREATE idx:docs ON JSON PREFIX 1 doc: SCHEMA \
'$.title' AS title TEXT '$.tags[*]' AS tags TAG '$.views' AS views NUMERIC SORTABLE
r FT.SEARCH idx:docs 'sandbox @views:[10 50]' SORTBY views DESC RETURN 2 title views
r FT.SEARCH idx:docs '@tags:{resume}' RETURN 1 title
# A vector set: add three 3-dimensional vectors, find the two closest to a query
r VADD emb VALUES 3 0.9 0.1 0.0 cat
r VADD emb VALUES 3 0.8 0.2 0.1 dog
r VADD emb VALUES 3 0.0 0.1 0.9 car
r VSIM emb VALUES 3 0.85 0.15 0.05 WITHSCORES COUNT 2OK
hello from the sandbox
OK
[13]
{"$.views":[13],"$.title":["Pause a sandbox"]}
OK
OK
2
doc:2
views
40
title
Fork a sandbox
doc:1
views
13
title
Pause a sandbox
1
doc:1
title
Pause a sandbox
1
1
1
cat
0.9978907108306885
dog
0.9973737895488739The first search finds both documents, sorted by views. The tag search finds only doc:1. Vector sets are new in Redis 8 and take plain numbers, so you can try similarity search from the shell without encoding binary vectors. FT.SEARCH with a VECTOR field and a KNN query also works, but needs the query vector as a binary blob, which is easier from a client library.
3. Redis Insight on a private URL#
Run Insight on the same Docker network, so it reaches Redis by the name redis. Bind it to loopback too, and host it with --localhost, which makes the sandbox relay the hosted URL to 127.0.0.1 (see Give a sandbox port an HTTPS URL).
sbx exec $id "docker run -d --name redisinsight --network redis-net --restart unless-stopped \
-p 127.0.0.1:5540:5540 -v redisinsight:/data redis/redisinsight:latest"
sbx exec $id "curl -s 127.0.0.1:5540/api/health/" # {"status":"up"}
sbx host $id 5540 --localhost --title "Redis Insight"https://lunar-happy-coral-5540.box.sandboxer.com?_token=<token>The URL is private by default:
curl -s -o /dev/null -w "%{http_code}\n" https://lunar-happy-coral-5540.box.sandboxer.com/
# 401
curl -s -c jar -o /dev/null -w "%{http_code}\n" "https://lunar-happy-coral-5540.box.sandboxer.com/?_token=<token>"
# 302
curl -s -b jar https://lunar-happy-coral-5540.box.sandboxer.com/ | grep -o "<title>.*</title>"
# <title>Redis Insight</title>In the browser, open the token link, choose Add Redis database, and enter host redis, port 6379. We did the same through Insight's own API, and it detected the modules:
sbx exec $id "curl -s -X POST 127.0.0.1:5540/api/databases -H content-type:application/json \
-d '{\"name\":\"sandbox-redis\",\"host\":\"redis\",\"port\":6379}'"{… "host":"redis","port":6379,"name":"sandbox-redis", … "provider":"REDIS_COMMUNITY_EDITION" …}The Redis Insight docs list RI_REDIS_HOST, RI_REDIS_PORT and RI_REDIS_ALIAS for preconfiguring a connection. With Insight 3.8.0 in our run, setting them didn't add a database (/api/databases returned []), so we added it by hand.
4. redis-cli from your laptop over ssh -L#
Redis listens on 127.0.0.1 inside the VM, so forward a local port to it over SSH. Save the stanza that sbx ssh-config prints and pass it with -F, as in the MySQL guide:
sbx ssh-config > sbx_ssh_config
ssh -F ./sbx_ssh_config -f -N -o ExitOnForwardFailure=yes -L 6380:127.0.0.1:6379 $id.sbx
redis-cli -p 6380 PING
redis-cli -p 6380 GET greeting
redis-cli -p 6380 JSON.GET doc:1 '$.views'
redis-cli -p 6380 VSIM emb ELE car COUNT 1
redis-cli -p 6380 --latencyPONG
hello from the sandbox
[13]
car
min: 124.382, max: 249.666, avg: 127.468 (58 samples)The tunnel goes through the Sandboxer API over HTTPS, so each round trip from our test machine cost about 127 ms, against 0.14 ms inside the VM. Use the tunnel for inspecting and debugging. Run anything chatty (a worker, a test suite, a benchmark) inside the sandbox. In our run the same tunnel kept working across the stop and resume below.
5. A measured number: redis-benchmark#
sbx exec $id "docker exec redis redis-benchmark -q -n 100000 -t set,get,incr,lpush,lpop"
sbx exec $id "docker exec redis redis-benchmark -q -n 100000 -P 16 -t set,get"SET: 75244.55 requests per second, p50=0.319 msec
GET: 86058.52 requests per second, p50=0.239 msec
INCR: 81300.81 requests per second, p50=0.287 msec
LPUSH: 77459.34 requests per second, p50=0.287 msec
LPOP: 99403.58 requests per second, p50=0.223 msec
SET: 591716.00 requests per second, p50=1.007 msec
GET: 990099.00 requests per second, p50=0.415 msecThat is with AOF on (everysec), 50 clients and the benchmark running on the same 4 vCPUs as Redis. The benchmark writes keys such as key:__rand_int__, so run it on a scratch database or FLUSHALL afterwards, and run BGREWRITEAOF to shrink the append-only file (ours grew to 19 MB and went back to 616 bytes).
6. What survives a stop and resume#
sbx exec $id "docker exec redis redis-cli SET before_stop \"\$(date -u +%T)\"" # OK
sbx stop $id --wait
sbx resume $id
sbx info $id --json | grep -o '"memoryRestored":[a-z]*' # "memoryRestored":true
sbx exec $id "docker exec redis redis-cli GET before_stop" # "10:29:33"While the sandbox was stopped, the Insight URL returned 404. After sbx resume it returned 200 with the old cookie, DBSIZE was unchanged, and the containers had kept running.
Resume restores memory in the normal case. When it boots from disk instead (for example after a resume onto a different CPU type), files are kept and processes are not. That is where the restart policy and AOF earn their place. To check that path without waiting for it, we restarted the Docker daemon:
sbx exec $id "systemctl is-enabled docker; sudo systemctl restart docker; sleep 5; \
docker ps --format '{{.Names}} {{.Status}}'; docker exec redis redis-cli GET before_stop"enabled
redisinsight Up 5 seconds
redis Up 5 seconds
10:29:33Docker starts at boot, unless-stopped brings both containers back, and Redis reloads its data, search index and vector set from the AOF.
Size and cost#
Idle, Redis used 6.5 MiB and Redis Insight 163 MiB, and the two images are 149 MB and 370 MB. A small sandbox is enough to try it. We used default ($0.036/hour while running) for the benchmark. A stopped sandbox isn't billed.
Clean up#
sbx delete $id --yesFAQ#
Is redis/redis-stack still the image to use?#
Redis's docs say Redis 8 replaces Redis Stack, and their Docker page uses redis:<version>. JSON, search, time series, probabilistic types and vector sets come built in, and Redis Insight is a separate redis/redisinsight image.
Should I set a Redis password?#
Set one with --requirepass if anything other than you can reach the port. In this setup Redis is bound to 127.0.0.1 inside the VM, so only processes in the sandbox and your SSH tunnel can reach it. Don't publish 6379 on 0.0.0.0 without a password.
Can I host Redis itself on an HTTPS URL?#
No. sbx host serves HTTP and WebSockets through an HTTPS proxy, and Redis speaks its own TCP protocol. Reach Redis over an SSH tunnel from your laptop, as in step 4, and host only Redis Insight.
Will my data survive an auto-stop?#
Yes. An auto-stop is the same memory-preserving stop as sbx stop. If a resume boots from disk, Docker restarts the containers and Redis reloads from the AOF in the redis-data volume.
Why is redis-cli slow from my laptop?#
The SSH tunnel crosses the Sandboxer API, so each command is a full round trip over the internet (about 127 ms in our test). Pipelines and --pipe help. For real load, run the client in the sandbox.
Related#
More guides
For running AI-written code we rank Sandboxer, Freestyle and E2B first: each gives code its own VM with an API or SDK and can pause with memory. Pick Daytona for Windows or GPUs, Modal or Northflank for GPUs at scale, E2B or Northflank to run in your own cloud, and Vercel Sandbox if your app lives on Vercel.
For coding agents we rank Sandboxer first: a full Ubuntu VM with Claude Code and Codex preinstalled, Docker, and stop-and-resume that keeps the agent's session in memory. Freestyle and Amp Orbs also keep memory across pauses. Pick E2B for prebuilt agent templates on open source, Docker Sandboxes for free local runs, and Codespaces if you live in GitHub.
The best Daytona alternatives depend on why you're switching. For a full Linux microVM on every sandbox with memory-saving stop and Docker, we rank Sandboxer first. E2B suits open source and self-hosting, Modal massive short-job fleets, Northflank bring-your-own-cloud with GPUs, and Vercel Sandbox apps on Vercel.
If you're leaving E2B for longer sessions or a fuller machine, we rank Sandboxer first, then Freestyle: both give each sandbox a full Linux VM that keeps memory across pauses, with Docker and no short session cap. Pick Daytona for Windows or GPUs, Northflank for bring-your-own-cloud, and stay on E2B if you need open source.