Summary
Plane's Docker entrypoint (docker-entrypoint-api.sh) unconditionally runs python manage.py clear_cache on every container startup. This command calls Django's cache.clear(), which in django-redis translates to a Redis FLUSHDB — wiping all keys in the entire Redis database, not just Plane's own cache entries.
When REDIS_URL points to a shared Redis instance (common in organizations that deploy Plane into existing infrastructure), this silently destroys data belonging to other services on the same database.
Why should this be worked on?
In a real production incident, Plane was deployed into a Kubernetes cluster where REDIS_URL was misconfigured to point at a shared Redis db0 used by other services. Every container restart (6 rounds of iterative deployment) triggered FLUSHDB, wiping all keys — including task queues, result caches, and runtime state of other applications — causing cascading failures across all dependent services.
Proposed improvements:
- Make
clear_cache skippable: Add an environment variable (e.g. PLANE_SKIP_CACHE_CLEAR=true) so operators can disable the startup cache flush when sharing a Redis instance.
- Add
KEY_PREFIX to Redis cache config: Configure a prefix like plane: in Django's CACHES setting, so even if clear_cache runs, it only affects Plane's own keys. This requires changing the clear_cache management command to use cache.delete_pattern("plane:*") instead of cache.clear(), since django-redis's clear() always calls FLUSHDB regardless of KEY_PREFIX (upstream issue).
- Document the risk: Note in the self-hosting docs that
REDIS_URL should point to a dedicated Redis database, and that startup will flush it.
Reference: django-redis clear() implementation calls client.flushdb() unconditionally. Django core has the same open issue: #35039.
Summary
Plane's Docker entrypoint (
docker-entrypoint-api.sh) unconditionally runspython manage.py clear_cacheon every container startup. This command calls Django'scache.clear(), which in django-redis translates to a RedisFLUSHDB— wiping all keys in the entire Redis database, not just Plane's own cache entries.When
REDIS_URLpoints to a shared Redis instance (common in organizations that deploy Plane into existing infrastructure), this silently destroys data belonging to other services on the same database.Why should this be worked on?
In a real production incident, Plane was deployed into a Kubernetes cluster where
REDIS_URLwas misconfigured to point at a shared Redis db0 used by other services. Every container restart (6 rounds of iterative deployment) triggeredFLUSHDB, wiping all keys — including task queues, result caches, and runtime state of other applications — causing cascading failures across all dependent services.Proposed improvements:
clear_cacheskippable: Add an environment variable (e.g.PLANE_SKIP_CACHE_CLEAR=true) so operators can disable the startup cache flush when sharing a Redis instance.KEY_PREFIXto Redis cache config: Configure a prefix likeplane:in Django'sCACHESsetting, so even ifclear_cacheruns, it only affects Plane's own keys. This requires changing theclear_cachemanagement command to usecache.delete_pattern("plane:*")instead ofcache.clear(), since django-redis'sclear()always callsFLUSHDBregardless ofKEY_PREFIX(upstream issue).REDIS_URLshould point to a dedicated Redis database, and that startup will flush it.Reference: django-redis
clear()implementation callsclient.flushdb()unconditionally. Django core has the same open issue: #35039.