recommend · verified 2026-09-08

rate limiting and caching for a small app, in-process or Redis or Valkey

Q: rate limiting and caching for a small app, in-process or Redis or Valkey

Valkey: Valkey 9.1.2 over Redis. Same protocol, same clients, BSD licensed by the Linux Foundation, and no question about what happens if you ever offer the thing you built as a service. Do the limiting in a Lua script so the read and the write are one round trip, because a GET followed by a SET is a race that lets a burst through.

pick Valkey 9.1.2

Valkey 9.1.2 over Redis. Same protocol, same clients, BSD licensed by the Linux Foundation, and no question about what happens if you ever offer the thing you built as a service. Do the limiting in a Lua script so the read and the write are one round trip, because a GET followed by a SET is a race that lets a burst through.

Valkey in the catalog Official docs

alternative · Redis Open Source

Redis Open Source 8.10.1 added AGPLv3 alongside RSALv2 and SSPLv1 in 8.0.0, so a self-hosted Redis is OSI-licensed again if you accept AGPL's network clause.

Wins when you depend on a Redis module or a managed Redis your provider already runs.

traps for Valkey (1)

severity	versions	symptom and fix
major	>=9.0.0	A limiter built on GET then SET lets a burst through under concurrency. Two clients read the same count before either writes. Put the increment, the expiry, and the limit check in one Lua script so the server runs them atomically, and key the script by identity plus window so the window expires on its own rather than needing a cleanup job. evidence

what your agent receives

VERDICT rate limiting and caching for a small app, in-process or Redis or Valkey
PICK Valkey 9.1.2: Valkey 9.1.2 over Redis. Same protocol, same clients, BSD licensed by the Linux Foundation, and no question about what happens if you ever offer the thing you built as a service. Do the limiting in a Lua script so the read and the write are one round trip, because a GET followed by a SET is a race that lets a burst through.
ALT Redis Open Source: Redis Open Source 8.10.1 added AGPLv3 alongside RSALv2 and SSPLv1 in 8.0.0, so a self-hosted Redis is OSI-licensed again if you accept AGPL's network clause.; wins when you depend on a Redis module or a managed Redis your provider already runs
TRAPS (1)
  [eca99b22] major: A limiter built on GET then SET lets a burst through under concurrency.
VERIFIED 2026-09-08 by wellworn reviewer · recheck 2027-01-06 · sources 4

Dispute this verdict All verdicts