Pika on Ubuntu 24.04 on Azure User Guide

Overview

Pika is a large-capacity, persistent, Redis-protocol-compatible key-value datastore backed by RocksDB. Unlike Redis, it keeps the dataset on disk (a RocksDB LSM tree) rather than in RAM, so a single node can serve very large keyspaces on commodity storage while still speaking the Redis wire protocol - any redis-cli or Redis client library connects unchanged. The cloudimg image installs Pika 3.5.6 from the pinned upstream release, runs it as a dedicated pika system user, stores the RocksDB dataset on a dedicated Azure data disk, and rotates a unique password into the image on first boot. Backed by 24/7 cloudimg support.

What is included:

• Pika 3.5.6 (RocksDB-backed, Redis protocol compatible) from the pinned upstream release
• A unique per-VM password generated on first boot (no shared default credential)
• The RocksDB dataset on a dedicated 16 GiB Azure data disk at /var/lib/pika
• Mandatory authentication on port 9221 via requirepass and userpass (no unauthenticated access)
• 24/7 cloudimg support

This is a datastore product: Pika listens on port 9221 and requires the password on every connection. It has no transport encryption, so for untrusted networks connect over an SSH tunnel rather than opening 9221 publicly.

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet + subnet in the target region. Standard_B2s (2 vCPU / 4 GiB RAM) is a good starting point. NSG inbound: allow 22/tcp from your management network. Open 9221/tcp only if you need direct remote access from a trusted network (Pika requires the password, but has no TLS).

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Pika by cloudimg, and select Create. On Basics pick your subscription, resource group, region and size; under Administrator account choose SSH public key and paste your key; under Inbound port rules allow SSH (22) only. Then Review + create -> Create.

Step 2 - Deploy from the Azure CLI

az vm create \
  --resource-group <your-rg> \
  --name pika \
  --image <marketplace-image-urn> \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm Pika is installed and running

/opt/pika/bin/pika -v
systemctl is-active pika

You should see Pika 3.5.6 and active:

-----------Pika server----------
pika_version: 3.5.6
pika_git_sha:25b18c3853bd803da42340838087b93564a1701d
pika_build_compile_date: 2025-09-09 15:13:25
active

Step 5 - Retrieve your per-VM password

Each VM generates its own unique Pika password on first boot and writes it to a root-only credentials file:

sudo cat /root/pika-credentials.txt

PIKA_PASSWORD=<your-unique-password>
PIKA_HOST=10.0.0.20
PIKA_PORT=9221
PIKA_PUBLIC_IP=10.0.0.20

The file also contains the redis-cli connection string and the SSH-tunnel instructions. Store the password in your secrets manager. In the commands below, <PIKA_PASSWORD> stands for the value of PIKA_PASSWORD.

Step 6 - Authenticate with redis-cli

Pika requires the password on every connection. Because Pika accepts any password when its user tier is left open, the cloudimg image sets both requirepass and userpass to the same per-VM password, so a wrong password is rejected. Authenticate and run a PING:

redis-cli -p 9221 -a <PIKA_PASSWORD> --no-auth-warning ping

PONG

Without the password, or with the wrong one, the datastore refuses the connection:

redis-cli -p 9221 ping
redis-cli -p 9221 -a wrongpass --no-auth-warning ping

ERR NOAUTH Authentication required.
AUTH failed: WRONGPASS invalid username-password pair or user is disabled.
ERR NOAUTH Authentication required.

Step 7 - Store and retrieve data

Pika speaks the Redis protocol, so every standard Redis command works unchanged. Set a string, read it back, increment a counter and push to a list:

redis-cli -p 9221 -a <PIKA_PASSWORD> --no-auth-warning set greeting "hello from Pika"
redis-cli -p 9221 -a <PIKA_PASSWORD> --no-auth-warning get greeting
redis-cli -p 9221 -a <PIKA_PASSWORD> --no-auth-warning set counter 100
redis-cli -p 9221 -a <PIKA_PASSWORD> --no-auth-warning incr counter
redis-cli -p 9221 -a <PIKA_PASSWORD> --no-auth-warning rpush mylist a b c
redis-cli -p 9221 -a <PIKA_PASSWORD> --no-auth-warning lrange mylist 0 -1

OK
hello from Pika
OK
101
3
a
b
c

Step 8 - Confirm persistence on the dedicated data disk

Unlike Redis, Pika stores the dataset on disk in RocksDB, so your keyspace is not bounded by RAM and survives restarts. The RocksDB data, logs and dumps live on the dedicated Azure data disk mounted at /var/lib/pika. Confirm the server details and that the dataset is on the data disk:

redis-cli -p 9221 -a <PIKA_PASSWORD> --no-auth-warning info server | grep -iE 'pika_version|config_file|os:'
findmnt -no SOURCE,TARGET,FSTYPE /var/lib/pika
ls -la /var/lib/pika/db

pika_version:3.5.6
os:Linux 6.17.0-1020-azure x86_64
config_file:/etc/pika/pika.conf
/dev/sdc /var/lib/pika ext4
drwxr-xr-x 8 pika pika 4096 Jul 19 03:41 db0

The RocksDB directory db0 on /dev/sdc (the dedicated data disk) is the durable dataset - snapshot the disk to back up your keyspace, or resize it independently of the OS disk.

Step 9 - Connect remotely

Pika listens on port 9221 and requires the password - there is no unauthenticated access - but it has no transport encryption. The secure default for untrusted networks is an SSH tunnel: forward the port over SSH and point a local client at localhost:9221:

# On your workstation:
ssh -L 9221:127.0.0.1:9221 azureuser@<vm-public-ip>

# In another terminal, with a local redis-cli:
redis-cli -h 127.0.0.1 -p 9221 -a <PIKA_PASSWORD> --no-auth-warning ping

For direct remote access from a trusted network you may instead open 9221/tcp in the VM's NSG and connect to redis-cli -h <vm-public-ip> -p 9221 -a <PIKA_PASSWORD>. The password is required either way. Never expose 9221 to the public internet without transport encryption (front it with stunnel, a service mesh, or a private NIC).

Maintenance

• Persistence: the RocksDB dataset, logs and dumps live on the dedicated data disk at /var/lib/pika, so the keyspace survives reboots and the volume is independently resizable.
• Password: change it by editing requirepass and userpass in /etc/pika/pika.conf and running sudo systemctl restart pika.
• Tuning: edit /etc/pika/pika.conf (for example maxmemory, thread-num, thread-pool-size) and restart the service.
• Security patches: unattended-upgrades remains enabled so the OS continues to receive security updates automatically.
• Compatibility: Pika speaks the Redis protocol - existing Redis clients, libraries and tooling work unchanged against 9221.

Support

cloudimg provides 24/7 expert support for this image. Contact support@cloudimg.co.uk.

Pika is a project of the OpenAtom Foundation. Redis is a trademark of Redis Ltd. This image is provided by cloudimg and is not affiliated with or endorsed by the OpenAtom Foundation or Redis Ltd.