Deploy Activepieces Hardened + Sandboxed

Deploy and Host Activepieces Hardened on Railway

Activepieces is an open source automation platform, a self hosted alternative to Zapier and Make, with 600+ integrations (pieces), webhooks, schedules, AI agents and an MCP server. This template runs it with the owner account created at deploy time, Code steps sandboxed, and Postgres plus Redis included.

About Hosting Activepieces Hardened

On a fresh Activepieces install the first person to open the sign-up page becomes the platform admin. This template closes that window: you enter your email at deploy, the container creates your account on loopback, and the healthcheck only passes after that, so the site never goes public unclaimed. Later sign-ups need an invitation. Code steps run in a V8 isolate (SANDBOX_CODE_ONLY) and flow code cannot reach private network addresses (AP_NETWORK_MODE=STRICT). The image is pinned to 0.92.3-hotfix.2, which includes the October 2026 Node.js security update and the fix for an unauthenticated webhook crash.

Common Use Cases

• Webhook and schedule driven automations between SaaS apps
• AI agents and MCP tools for Claude, Cursor and other clients
• Internal workflows with approvals, forms and tables

Dependencies for Activepieces Hardened Hosting

• Postgres (pgvector/pgvector:0.8.2-pg17, included; pgvector enables the knowledge base feature)
• Redis (redis:7.4.6-alpine, included, persistent queue)

Deployment Dependencies

• Activepieces docs
• Sandboxing modes
• Environment variables

What's included

First steps after deploy

1. Open the Activepieces domain.
2. Sign in with AP_ADMIN_EMAIL and the generated AP_ADMIN_PASSWORD (Activepieces service, Variables tab).
3. Change your password, then invite teammates from Platform Admin.
4. Build a flow. Webhook URLs look like https:///api/v1/webhooks/.

Key environment variables

• AP_ADMIN_EMAIL: platform owner, the only value you enter.
• AP_ADMIN_PASSWORD: generated first login password, used on first boot only.
• AP_EXECUTION_MODE: SANDBOX_CODE_ONLY (default, no npm packages in Code steps) or UNSANDBOXED (npm allowed, only for fully trusted builders).
• AP_NETWORK_MODE: STRICT by default; allow private targets with AP_SSRF_ALLOW_LIST.
• AP_FRONTEND_URL: update after adding a custom domain.
• AP_ENCRYPTION_KEY: never change after first boot.

A Hobby plan or higher is recommended for the Activepieces service.

Why Deploy Activepieces Hardened on Railway?

Railway is a singular platform to deploy your infrastructure stack. Railway will host your infrastructure so you don't have to deal with configuration, while allowing you to vertically and horizontally scale it.

By deploying Activepieces Hardened on Railway, you are one step closer to supporting a complete full stack application with minimal burden. Host your servers, databases, AI agents, and more on Railway.