Skip to content
Qdrant Vector Database AI Platform & Data · Qdrant v1.19.2 Launch on AWS

Operations

This page covers running Qdrant day to day: how it is secured, how to manage the service, where logs go, what to back up, how updates work and how to get help.

Security model

  • Loopback only. HTTP listens on 127.0.0.1:6333 and gRPC on 127.0.0.1:6334. Nothing listens on a public interface.
  • API key. Every call except /readyz and /healthz needs the key. A call without it, or with a wrong key, is refused.
  • Per-instance secret. The key is created on first boot. The image contains none.
  • File permissions. /etc/qdrant/credentials is readable by root only. Neither the ubuntu user nor the qdrant service user can read the key; systemd reads the environment file as root before it starts Qdrant.
  • Service sandbox. The qdrant service runs as the qdrant user, can write only to /var/lib/qdrant and sees /etc/qdrant as read-only.
  • Helper client. /opt/sushi/bin/qdrant-api reads the key itself and refuses header or key arguments, so the key never appears in your shell history or the process list.

Keep the security group closed to inbound traffic, and connect with Session Manager or SSH restricted to your administrative range.

Manage the service

sudo systemctl status qdrant
sudo systemctl restart qdrant
sudo systemctl stop qdrant

Check that Qdrant is ready:

curl -sS http://127.0.0.1:6333/readyz

Logs

Qdrant logs to the systemd journal:

sudo journalctl -u qdrant -n 100 --no-pager
sudo journalctl -u sushi-qdrant-firstboot --no-pager

Backups

To keep a collection, create a snapshot with the Qdrant API. It is written to /var/lib/qdrant/snapshots:

sudo /opt/sushi/bin/qdrant-api POST /collections/<collection>/snapshots

To move the whole database, with the same API key, to a replacement instance, stop Qdrant and copy these together over a private channel:

  • /var/lib/qdrant/storage
  • /var/lib/qdrant/snapshots
  • /etc/qdrant/config.yaml
  • /etc/qdrant/credentials/

Restore them with the same ownership and permissions before Qdrant starts: storage and snapshots belong to qdrant:qdrant, the credentials directory to root:root with mode 0700. You can also take EBS snapshots of the volume. Never put the key or these files in a ticket.

Updates

  • Ubuntu packages, including OpenSSL, receive unattended security updates.
  • Qdrant itself is not updated by apt. A new Qdrant release comes as a new version of the image. There is no in-place upgrade: launch the new version, copy your storage and credentials if you want to keep them, and point clients at the new instance.

Support

Software Sushi supports the packaging, first-boot setup and this documentation. Email info@softwaresushi.com with your instance's Qdrant version (/usr/bin/qdrant --version), what you ran and the error. Never include the API key. Support coverage beyond installation questions requires a separate agreement. Qdrant Solutions GmbH does not provide support for this image.

Last updated October 13, 2026 · Suggest an improvement