Hardened Valkey on Ubuntu 26.04 by Verified Images

This is a repackaged open source software product wherein additional charges apply for the hardened, security-maintained image (rebuilt and re-verified as new CVEs are disclosed).

Verified Images publishes a hardened, production-ready Valkey server on Ubuntu 26.04 LTS. Valkey is the high-performance, open-source, in-memory key-value data store used for caching, session storage, queues, rate limiting, and real-time data. It is a drop-in, protocol-compatible continuation of the widely used Redis key-value store, stewarded under the Linux Foundation, and it speaks the same wire protocol, so existing clients, libraries, and tooling connect unchanged. The server is tuned and locked down at first boot, so you get a running, maintained data store in minutes instead of installing and hardening it by hand, and it is a clean drop-in replacement for other self-managed Redis-compatible images.

What's included beyond a stock install:

• No baked-in credentials: on first launch the image generates a unique, random per-instance password and sets it as the Valkey password (requirepass), so authentication is required from the first connection. The password is retrievable only by the holder of the SSH key (from the login banner, the operator CLI, or a root-only file); nothing secret is stored in the AMI, and every instance is unique.
• Secure by default: the server is baked bound to localhost with no listener exposed; first boot sets the password before opening the network listener, so a public port is never served without authentication. Protected mode is on and remote access is opt-in.
• TLS available: point your own certificate at the server and switch to encrypted client connections with one command.
• Durable by default: append-only file (AOF) persistence and periodic snapshots are enabled so data survives restarts.
• A one-command operator CLI (valkeyctl): status, connection details, password rotation, on-demand snapshot backups, guided restore, and enabling TLS or remote access, all in a single tool.
• A hardened OS baseline (inherited from the Verified Images hardened Ubuntu 26.04 image): SSH password authentication and root login are disabled, a kernel/network sysctl hardening profile is applied, no default OS passwords or SSH keys are baked in, the service runs as an unprivileged systemd unit, and automatic OS security patching (unattended-upgrades) is enabled.
• AWS Systems Manager (SSM) agent preinstalled for keyless, auditable instance management.
• Ongoing security maintenance: the hardened image is rebuilt and re-verified as new CVEs are disclosed, so new launches stay current.

Valkey is licensed under the permissive BSD 3-Clause License and is fully open source; it allows commercial use, modification, and redistribution with attribution, and is not a source-available or resale-restricted product. Verified Images ships Valkey specifically because it remains permissively licensed after Redis, the project it continues, moved to a source-available license that no longer permits this kind of packaging. Valkey is a trademark of its project under the Linux Foundation, and Redis is a trademark of Redis Ltd.; both names are used only to describe what this image is and is compatible with. Verified Images is an independent repackager and is not affiliated with, sponsored by, or endorsed by the Valkey project, the Linux Foundation, or Redis Ltd.