Show HN: KiviDB, a faster Redis-compatible memory database and vector cache

KiviDB is a fast, multi-threaded substitute to Redis® and Valkey, written in Rust. It speaks the Redis protocol (RESP2 and RESP3), so existing Redis clients, redis-cli and libraries activity unchanged, and it has full-text and vector hunt built in. It runs every core on a sharded in-memory key-value design, and persists to snapshots and an optional append-only file.

On the identical 32 cores, KiviDB serves 21 myriad pipelined GETs per second: concerning 9× Redis 8 and 2.3× Dragonfly, alongside under fractional Dragonfly's p99 latency (benchmarks).

docker run -d -p 6380:6380 kividb/kividb redis-cli -p 6380 PING # PONG

KiviDB listens on 6380, not Redis's 6379, so the two can run flank by side; item your client at that port, or continue --port 6379.

• Protocol: Redis-compatible command exterior (see COMMANDS.md for the supported commands)
• Search and vectors: Redis Stack–style FT.* commands for full-text, tag, numeric and vector (FLAT / HNSW) search
• Lua scripting: optional Cargo feature. EVAL, SCRIPT, FUNCTION, FCALL and connected commands are accessible in builds alongside --features lua (see Scripting commands (Lua))
• TLS: optional Cargo characteristic (--features tls)
• Default hear address: 0.0.0.0:6380, alongside protected mode on
• License: GNU Affero General Public License v3 (AGPL-3.0-only), open source; using KiviDB does not put your use under the AGPL; see License

Repository: github.com/kividbio/kividb · Website: kividb.io

As of October 2026. Something out of date or wrong? Please open an issue.

Throughput, latency, vector hunt and vector ingest. Click for the full-resolution video.

All figures below are from one meeting in October 2026 on AWS Graviton3 naked metal: the server on a c7gn.metal (64 vCPU), confined to 32 cores, and the burden generator on a second c7gn.metal in the identical placement group. Each motor ran solitary on the server, one following another.

memtier_benchmark through kivi-benchmark's run-matrix.sh: 10 myriad keys, 100-byte values, 30 s a scenario, average of two rounds; 300 connections pipelined, 1,200 without pipelining.

redis/vector-db-benchmark on glove-25-angular (1.18M vectors, 25 dimensions): HNSW alongside M=16 and EF_CONSTRUCTION=256, 100 clients uploading in batches of 64, afterward queries at ef 64, 128, 256 and 512.

• Methodology and scripts: kivi-benchmark
• The most latest automated run: benchmarks/LATEST.md

Results depend on the environment. Treat published figures as one controlled capture, not a guarantee, and measure on your own hardware and workload.

KiviDB implements Redis Stack–compatible hunt and vector commands, so existing clients and tutorials mostly activity unchanged. Use them for full-text (BM25), tags / numerics, and vector ANN (FLAT or HNSW) on hash fields.

1. Create an index on keys alongside a prefix, declaring at smallest one VECTOR site (HNSW or FLAT) and optional TEXT / TAG / NUMERIC fields:

redis-cli -p 6380 FT.CREATE idx ON HASH PREFIX 1 doc: SCHEMA \ vec VECTOR HNSW 10 TYPE FLOAT32 DIM 128 DISTANCE_METRIC COSINE M 16 EF_CONSTRUCTION 128

2. Store vectors as raw FLOAT32 little-endian bytes in a hash site (DIM × 4 bytes), the identical gathering as Redis Stack and redis-py / numpy blobs. Use your client's binary-safe HSET (the integration tests under tests/e2e/ have examples).

3. Query alongside KNN (Dialect 2), passing the query vector as a named binary parameter:

redis-cli -p 6380 FT.SEARCH idx '*=>[KNN 10 @vec $q]' PARAMS 2 q <blob> DIALECT 2

The complete command surface, filters, hybrid hunt and border cases are in COMMANDS.md (search for FT.CREATE, FT.SEARCH, FT.HYBRID, and so on).

• Native snapshots (dump.kdb) shop the keys, the index schemas, and, whenever you SAVE / BGSAVE alongside indexes populated, the HNSW graph of all vector field, so hunt norm following a restart matches the chart you had before shutdown.
• While hunt indexes are being rebuilt at startup, most commands come back LOADING until the rebuild finishes; PING, INFO and a few another commands motionless work.
• After a ample ingest, run SAVE (or agenda BGSAVE) so the next commencement reloads the chart from disk alternatively of rebuilding it from the hashes.

KiviDB comes in four variants, chosen by Cargo features at build time:

In a build without Lua, the scripting commands come back an error. A build without TLS refuses to commencement if --tls-port is given, fairly than serving plaintext.

Requires a stable Rust toolchain (rust-toolchain.toml selects stable alongside rustfmt and clippy). The crate uses the 2024 edition; the oldest toolchain it is checked against is Rust 1.89, the type the Dockerfile builds with.

git copy https://github.com/kividbio/kividb.git cd kividb cargo build --release # default variant cargo build --release --features lua # alongside Lua scripting cargo build --release --features tls # alongside TLS cargo build --release --features lua,tls # full ./target/release/kividb

On Linux the server uses io_uring whenever the kernel allows it and falls rear to Tokio otherwise (--io-model auto, the default).

To build the Docker depiction yourself, docker build -t kividb . builds the default variant; docker build --build-arg KIVIDB_FEATURES=lua,tls -t kividb:full . builds another one.

./target/release/kividb # listens on 0.0.0.0:6380 redis-cli -p 6380 PING

Any Redis client works; item it at harbor 6380.

Protected manner is on by default, as in Redis. While it is on, no tie location has been set (--bind or tie in the config file) and the default person has no password, only clients on the identical device (loopback) may connect. Any another client receives a -DENIED error that explains the options, and is disconnected.

To obtain clients from another machines, do one of these:

• set a password: --requirepass <password>, or ACL SETUSER default ><password>;
• set a tie address: --bind <address>;
• turn protected manner off: --protected-mode no, protected-mode no in the config file, or CONFIG SET protected-mode no from a local client.

If you rotate it off or tie to a community address, create certain the server cannot be reached from the net without a password.

Images are published to Docker Hub and the GitHub Container Registry, with the identical tags in both:

docker drag kividb/kividb:latest # or docker drag ghcr.io/kividbio/kividb:latest

latest and type tags specified as v1.1.0 are the default variant; v1.1.0-lua, v1.1.0-tls and v1.1.0-full are the others. Images are built for amd64 and arm64.

docker run -p 6380:6380 kividb/kividb

A receptacle is reached through its network, never from loopback, so the image's default command is --protected-mode no. Arguments you continue substitute that default, which turns protected manner rear on. When you continue your own flags, set a password (recommended) or add --protected-mode no yourself:

docker run -p 6380:6380 ghcr.io/kividbio/kividb \ --requirepass "change-me" \ --databases 8 \ --loglevel debug

With AOF persistence (mount a quantity so data survives restarts; the server runs as user kividb in /home/kividb):

docker run -p 6380:6380 \ -v $(pwd)/data:/home/kividb \ ghcr.io/kividbio/kividb --aof --requirepass "change-me"

With --aof, all compose is appended to appendonly.aof and the document is replayed on startup, so a collision loses at most concerning the final second of writes (the fsync interval) rather than everything since the final snapshot. When an AOF is current it is the origin of truth and the snapshot is not loaded; see docs/PERSISTENCE.md for why.

io_uring in containers: Docker's default seccomp overview blocks io_uring on recent versions, and KiviDB afterward falls rear to Tokio. To authorize it on a Linux host, run with --security-opt seccomp=unconfined (understand what that permits before using it in production).

Release binaries for Linux (x86_64, aarch64) and macOS (Apple silicon, Intel) are published on GitHub Releases. The latest/download links below continually determine to the newest release; substitute latest/download with download/v1.1.0 to pin a version.

# Linux x86_64 curl -LO https://github.com/kividbio/kividb/releases/latest/download/kividb-linux-x86_64.tar.gz tar xzf kividb-linux-x86_64.tar.gz ./kividb # Linux aarch64 (an ARMv8.1 CPU or newer: Graviton2 and later, Ampere; not a Raspberry Pi 4) curl -LO https://github.com/kividbio/kividb/releases/latest/download/kividb-linux-aarch64.tar.gz # macOS, Apple silicon / Intel curl -LO https://github.com/kividbio/kividb/releases/latest/download/kividb-darwin-aarch64.tar.gz curl -LO https://github.com/kividbio/kividb/releases/latest/download/kividb-darwin-x86_64.tar.gz

Each type another than the default has its name in the file: kividb-lua-linux-x86_64.tar.gz, kividb-tls-…, kividb-full-…. The default type is additionally packaged for Linux as kividb_amd64.deb / kividb_arm64.deb and kividb.x86_64.rpm / kividb.aarch64.rpm, built alongside nfpm from packaging/nfpm.yaml. A SHA256SUMS.txt document lists the checksum of all document in a release.

curl -LO https://github.com/kividbio/kividb/releases/latest/download/kividb_amd64.deb && sudo dpkg -i kividb_amd64.deb curl -LO https://github.com/kividbio/kividb/releases/latest/download/kividb.x86_64.rpm && sudo rpm -i kividb.x86_64.rpm

KiviDB is configured alongside command-line flags, or alongside a Redis-style configuration file (one directive per line, specified as harbor 6380 or appendonly yes). The document is peruse from /etc/kividb/kividb.conf if it exists; --configfile <path> names another one. A emblem given on the command row wins complete the identical environment in the file. Run kividb --help for the full list.

TLS clients nexus on a distinct port, --tls-port; plain traffic stays on --port.

cargo build --release --features tls ./target/release/kividb --port 6380 --tls-port 6381 --tls-cert-file cert.pem --tls-key-file key.pem redis-cli --tls -p 6381 --cacert ca.pem # ca.pem: the CA that signed cert.pem

Client certificates (mutual TLS). With --tls-ca-cert-file ca.pem, clients must current a certificate signed by that CA; others are refused during the handshake. --tls-auth-clients optional accepts clients without a certificate but motionless refuses an invalid one, and --tls-auth-clients no does not ask for one. With redis-cli: redis-cli --tls -p 6381 --cacert ca.pem --cert client.pem --key client.key.

Clients must use TLS on the TLS port. A plain association to it (for example redis-cli -p 6381 without --tls) fails the handshake, and the server logs [TLS] handshake failed. For memtier_benchmark, add --tls (and --tls-skip-verify for a self-signed certificate).

The log goes to norm error, or to --logfile. docs/LOGGING.md describes the log; docs/ERRORS.md explains the warnings, errors and error replies, and what to do concerning each.

When it starts, a publish build of KiviDB makes one HTTPS request to https://github.com/kividbio/kividb/releases/latest, the identical leaf you would open to find the newest release. GitHub answers alongside a redirect to that release's tag; if it is newer than the operating build, KiviDB prints a abbreviated notice alongside the nexus before the startup banner. Nothing is sent but the petition itself, alongside a User-Agent of kividb/<version>: no presenter name, configuration, keys, data or identifier. GitHub sees the request's origin IP address, as any web server would.

Startup waits at most 1.5 seconds for the reply; a nonaccomplishment is logged at debug flat lone and never affects clients. Only a version-shaped tag is accepted from the reply, and nothing else from it is printed.

Any one of these turns it off:

• --update-check no on the command line;
• update-check no in the configuration file;
• KIVIDB_NO_UPDATE_CHECK=1 in the environment.

It is additionally never made by a debug build or whenever the CI surroundings changeable is set. --update-check-url points it at another https:// address, specified as a mirror inner a closed network. docs/UPDATE_CHECK.md has the details.

Contributions are welcome. See CONTRIBUTING.md for how to build, test and present changes. Contributions are accepted under the Contributor License Agreement, which you sign on your archetypal drag request.

Please prosecute the Code of Conduct. The Changelog lists what changed in all release.

Please do not study safety vulnerabilities in community issues. See SECURITY.md for how to study one privately.

Copyright (c) 2026 KIVIDB PRIVATE LIMITED.

KiviDB is open origin software, licensed under the GNU Affero General Public License, type 3 (AGPL-3.0-only), an OSI-approved license. You may use, modify and redistribute it under its terms. See NOTICE.

Using KiviDB does not put your use under the AGPL. An use that talks to KiviDB complete the network, through any Redis client, is a distinct program: you can run an unmodified KiviDB as your database, in any product, open or closed, business or not, with no duty on your application's code. The AGPL asks for one item beyond the GPL: if you modify KiviDB itself and let others use your modified type complete a network (for example, as a hosted service), you must recommendation them the origin code of your modified KiviDB.

Commercial license. KIVIDB PRIVATE LIMITED owns the copyright in KiviDB and additionally offers it under a business license, for organizations that cannot use AGPL application or that want to modify or embed KiviDB without publishing their changes. Write to [email protected].

Our commitment. Every type of KiviDB we publish under the AGPLv3 stays available under the AGPLv3. The Contributor License Agreement lets us recommendation the commercial license alongside it; it is not a way to obtain the open origin type away.

• Can I use KiviDB as the repository of my closed-source or business application? Yes. Your use connects to KiviDB complete the network; it is not a derivative of KiviDB, and the AGPL places no duty on it.
• Can I run KiviDB as a assistance for my own users or customers? Yes. If you run it unmodified, you have nothing to publish. If you modify KiviDB and recommendation that modified version complete a network, you must recommendation its origin to the users of that service.
• Do client libraries or my configuration figure as modifications? No. Redis clients, configuration files, and scripts and functions you dispatch to KiviDB are not part of KiviDB.
• My institution does not authorize AGPL software. The business licence is for that case: [email protected].

Redis® is a registered trademark of Redis Ltd. Any entitlements therein are reserved to Redis Ltd. Any use by KiviDB is for referential purposes lone and does not signify any sponsorship, endorsement or affiliation between Redis and KiviDB. KiviDB is not affiliated alongside Redis Ltd. Other names mentioned are trademarks of their corresponding owners.