Redrive

Deployment

One Redrive instance can serve a single developer or a whole team; what changes is where it binds and whether the password gate is set.

Docker

For local use, bind to loopback only:

docker run -d --name redrive \
  -p 127.0.0.1:8080:8080 \
  -v redrive-data:/data \
  redrive/redrive

For a shared instance, bind wide and set the password gate:

docker run -d --name redrive \
  -p 8080:8080 \
  -v redrive-data:/data \
  -e REDRIVE_PASSWORD=change-me \
  redrive/redrive

Without a password, anyone who can reach the port can operate every broker you connect. Set REDRIVE_PASSWORD whenever the port is reachable beyond localhost.

The container healthchecks itself against /healthz, so docker ps and any orchestrator in front of it can tell when Redrive is ready, not just running.

Upgrading the container

Pull the new image, remove the old container, and start a new one on the same volume:

docker pull redrive/redrive
docker rm -f redrive
docker run -d --name redrive \
  -p 8080:8080 \
  -v redrive-data:/data \
  -e REDRIVE_PASSWORD=change-me \
  redrive/redrive

State lives in the redrive-data volume, not the container, so it survives the swap.

TLS

Redrive does not terminate TLS; run it behind a reverse proxy. Proxy your domain to the Redrive port with Caddy, which handles certificates on its own:

caddy reverse-proxy --from redrive.example.com --to localhost:8080

Server mode

Binding beyond loopback turns Redrive into a shared workspace. One password gates the whole instance, and everyone who has it sees every connection. There is no per-user separation, so treat a shared instance as a team tool, not a multi-tenant one.

Licensed installs

A licensed install needs outbound HTTPS (port 443) to licensing.redrive.dev — one hostname, nothing else. Egress-locked networks should allow exactly that. An install that loses the connection keeps working: paid features carry a 14-day grace window, and the free tier never degrades at all. Configuration covers REDRIVE_LICENSE_KEY for activating Docker and IaC deployments without touching the UI.

Downgrades

A database migrated by a newer version does not open in an older one. If a release breaks something for you, wait for a hotfix or ask for one; downgrading the binary is not a safe way back.

Next

Continue to Security for what Redrive protects and what it doesn't.