Describe the bug

Unable to define an ACL entry in the redis.conf file while running the Redis server in docker-compose. I have followed the description of how to define ACL rules in redis.conf described here, but when I attempt to specify the allchannels option I receive the following error 

redis_1  | 
redis_1  | *** FATAL CONFIG FILE ERROR (Redis 6.0.9) ***
redis_1  | Reading the configuration file, at line 763
redis_1  | >>> 'user default allkeys allchannels allcommands on #4d192ef73b3ddfcf307fd159d6076fc4d94e1079fa9ad10f9cc5eb9db1612cca'
redis_1  | Error in user declaration 'allchannels': Syntax error

As soon as I remove the allchannels ACL rule the container starts normally.

To reproduce

  1. Create a working directory and go into it
  2. Inside the working directory run the following command mkdir -p container-configuration/redis
  3. Add the default redis.conf file as found here to container-configuration/redis
  4. Add the following user default allkeys allchannels allcommands on #4d192ef73b3ddfcf307fd159d6076fc4d94e1079fa9ad10f9cc5eb9db1612cca into line 753 (so directly after the commend block describing the usage of ACL rules
  5. Create the following docker-compose.yml next to the directory container-configuration
version: '3.8'

services:
    redis:
        image: redis:6.0
        restart: always
        ports:
            - 6379:6379
        volumes:
            - './container-configuration/redis/redis.conf:/usr/local/etc/redis/redis.conf'
        command: '/usr/local/etc/redis/redis.conf'

At this point the directory layout inside the working directory should be as follows

.
├── container-configuration
│   └── redis
│       └── redis.conf
├── docker-compose.yml
  1. Executed docker-compose up from the root of the working directory

Expected behavior

Container starts as normal. And the user default is configured to have access to all keys, all channels and all commands and it is possible to login with the password of which the SHA-256 hash is 4d192ef73b3ddfcf307fd159d6076fc4d94e1079fa9ad10f9cc5eb9db1612cca

Additional information

OS: Linux 4.9.0-8-amd64 #1 SMP Debian 4.9.130-2 (2018-10-27) Redis Version: 6.0.3

While I believe this is not an issue with Docker I have included the details of my docker installation below docker-compose version 1.26.0, build d4451659 Docker version 19.03.11, build 42e35e61f3

Comment From: itamarhaber

Hello @pgerhard

Thank you for reaching out with this. Please note that ACL support for Pub/Sub is planned to be included in the upcoming version of Redis, namely 6.2. Currently, this functionality is only available in the unstable branch of this repository, and as far as I know, Docker does not maintain a container image for it.

The good news is that 6.2 is expected to be released soon(tm), so once it is out it would take about 24 hours for the new Docker hub image to become available.

Comment From: pgerhard

Hello @itamarhaber,

Thank you for getting back to me this soon. Is there any documentation available on how to set up permissions for Pub/Sub in version 6.0.x? If so it would be create if you could point me in that direction.

Comment From: itamarhaber

Regrettably, Redis 6.0.x offers limited permission control with regards to Pub/Sub. You can permit/block the associated commands, i.e. PUBLISH/SUBSCRIBE/..., per user. You can even do something like ACL SETUSER ... +publish|foo to restrict access to a channel, but that's about it.

As I wrote above, version 6.2 addresses this gap with the new functionality that it adds. This functionality, however, will not be backported to version 6.0, so I recommend that you stay tuned for 6.2's GA (should be at the beginning of next year). Does this make sense to you? Let me know if there's anything else I can help with.

Comment From: pgerhard

Yeah that makes sense to me. The only thing I would suggest is mentioning this limitation in the ACL documentation

Comment From: itamarhaber

Thanks for the confirmation @pgerhard. As for the docs, it is actually there, please see:

  • The history section of ACL SETUSER
  • Around the middle of the "Creating and editing users ACLs with the ACL SETUSER command" section in the ACL doc, where it states: "New users are created with restrictive permissions by default. Starting with Redis 6.2, ACL provides Pub/Sub channels access management as well. To ensure backwards compatability with version 6.0 when upgrading to Redis 6.2, new users are granted the 'allchannels' permission by default. The default can be set to resetchannels via the acl-pubsub-default configuration directive."

That said, we always welcome contributions to the docs repo at https://github.com/redis/redis-doc.

Closing this as resolved by feel free to reopen or create a new issue if needed.