---
title: "Deploy Activepieces Hardened + Sandboxed"
description: "Activepieces automation with sandboxed code steps and a pre-claimed owner"
category: "Automation"
url: https://railway.com/deploy/activepieces-hardened-sandboxed
---

# Deploy Activepieces Hardened + Sandboxed

Activepieces automation with sandboxed code steps and a pre-claimed owner

**[Deploy Activepieces Hardened + Sandboxed on Railway](https://railway.com/template/activepieces-hardened-sandboxed)**

Machine-readable deploy manifest (JSON, validated by TemplateCI): https://railway.com/deploy/activepieces-hardened-sandboxed/manifest.json

- **Creator:** Protemplate
- **Category:** Automation
- **Total deploys:** 2

## Template content

### Redis https://avatars.githubusercontent.com/u/1529926?v=4

- **Image:** redis:7.4.6-alpine
- **Start command:** `sh -c 'exec docker-entrypoint.sh redis-server --requirepass "$REDIS_PASSWORD" --appendonly yes --save 60 1 --maxmemory-policy noeviction --dir /data --bind :: 0.0.0.0'`

### Postgres https://avatars.githubusercontent.com/u/177543?v=4

- **Image:** pgvector/pgvector:0.8.2-pg17
- **Start command:** `docker-entrypoint.sh postgres -c "listen_addresses=*"`

### Activepieces https://avatars.githubusercontent.com/u/99494700?v=4

- **Image:** ghcr.io/activepieces/activepieces:0.92.3-hotfix.2
- **Start command:** `sh -c 'echo Ly8gUmFpbHdheSBvd25lciBib290c3RyYXAgZm9yIEFjdGl2ZXBpZWNlcyAocnVucyBpbiB0aGUgYmFja2dyb3VuZCBuZXh0IHRvIGRvY2tlci1lbnRyeXBvaW50LnNoKS4KLy8gMS4gV2FpdHMgZm9yIHRoZSBBUEkgb24gbG9vcGJhY2suIDIuIElmIG5vIHVzZXIgZXhpc3RzIHlldCAoR0VUIC9hcGkvdjEvZmxhZ3MgVVNFUl9DUkVBVEVEKSwKLy8gc2lnbnMgdXAgQVBfQURNSU5fRU1BSUwgLyBBUF9BRE1JTl9QQVNTV09SRCwgd2hpY2ggb24gQ29tbXVuaXR5IEVkaXRpb24gY3JlYXRlcyB0aGUgcGxhdGZvcm0gYW5kCi8vIG1ha2VzIHRoYXQgYWNjb3VudCBpdHMgYWRtaW4uIDMuIE9ubHkgdGhlbiB3cml0ZXMgdGhlIGhlYWx0aGNoZWNrIG1hcmtlciByYWlsd2F5LXJlYWR5Lmpzb24uCi8vIFJhaWx3YXkgcm91dGVzIG5vIHB1YmxpYyB0cmFmZmljIHRvIGEgZGVwbG95bWVudCBiZWZvcmUgaXRzIGhlYWx0aGNoZWNrIHBhc3Nlcywgc28gdGhlCi8vIHNpZ24tdXAgZm9ybSBpcyBuZXZlciByZWFjaGFibGUgd2hpbGUgdGhlIGluc3RhbmNlIGlzIHVuY2xhaW1lZC4gSWRlbXBvdGVudDogb24gbGF0ZXIgYm9vdHMKLy8gVVNFUl9DUkVBVEVEIGlzIGFscmVhZHkgdHJ1ZSBhbmQgaXQgb25seSB3cml0ZXMgdGhlIG1hcmtlciAoYSBjaGFuZ2VkIHBhc3N3b3JkIGlzIG5ldmVyIHJlc2V0KS4KY29uc3QgZnMgPSByZXF1aXJlKCJmcyIpOwpjb25zdCBUQUcgPSAiW3JhaWx3YXktYm9vdHN0cmFwXSI7CmNvbnN0IEFQSSA9ICJodHRwOi8vMTI3LjAuMC4xOiIgKyAocHJvY2Vzcy5lbnYuQVBfUE9SVCB8fCAiODAiKSArICIvYXBpL3YxIjsKY29uc3QgTUFSS0VSID0gIi91c3Ivc3JjL2FwcC9kaXN0L3BhY2thZ2VzL3dlYi9yYWlsd2F5LXJlYWR5Lmpzb24iOwpjb25zdCBlbWFpbCA9IChwcm9jZXNzLmVudi5BUF9BRE1JTl9FTUFJTCB8fCAiIikudHJpbSgpOwpjb25zdCBwYXNzd29yZCA9IHByb2Nlc3MuZW52LkFQX0FETUlOX1BBU1NXT1JEIHx8ICIiOwpjb25zdCBzbGVlcCA9IChtcykgPT4gbmV3IFByb21pc2UoKHIpID0+IHNldFRpbWVvdXQociwgbXMpKTsKY29uc3QgY2FsbCA9IChwYXRoLCBpbml0KSA9PiBmZXRjaChBUEkgKyBwYXRoLCBpbml0KS5jYXRjaCgoKSA9PiBudWxsKTsKCihhc3luYyAoKSA9PiB7CiAgdHJ5IHsgZnMudW5saW5rU3luYyhNQVJLRVIpOyB9IGNhdGNoIHt9CiAgZm9yICg7OykgewogICAgY29uc3QgaCA9IGF3YWl0IGNhbGwoIi9oZWFsdGgiKTsKICAgIGlmIChoICYmIGgub2spIGJyZWFrOwogICAgYXdhaXQgc2xlZXAoMjUwKTsKICB9CiAgbGV0IHdhaXQgPSAxMDAwOwogIGZvciAoOzspIHsKICAgIGNvbnN0IGYgPSBhd2FpdCBjYWxsKCIvZmxhZ3MiKTsKICAgIGNvbnN0IGZsYWdzID0gZiAmJiBmLm9rID8gYXdhaXQgZi5qc29uKCkuY2F0Y2goKCkgPT4gbnVsbCkgOiBudWxsOwogICAgaWYgKGZsYWdzICYmIGZsYWdzLlVTRVJfQ1JFQVRFRCA9PT0gdHJ1ZSkgYnJlYWs7CiAgICBpZiAoZmxhZ3MpIHsKICAgICAgaWYgKCFlbWFpbC5pbmNsdWRlcygiQCIpIHx8IHBhc3N3b3JkLmxlbmd0aCA8IDggfHwgcGFzc3dvcmQubGVuZ3RoID4gNjQpIHsKICAgICAgICBjb25zb2xlLmVycm9yKFRBRywgIkFQX0FETUlOX0VNQUlMIG9yIEFQX0FETUlOX1BBU1NXT1JEICg4IHRvIDY0IGNoYXJzKSBpcyBtaXNzaW5nIG9yIGludmFsaWQ7IGluc3RhbmNlIHN0YXlzIHVucmVhZHkiKTsKICAgICAgfSBlbHNlIHsKICAgICAgICBjb25zdCBib2R5ID0gSlNPTi5zdHJpbmdpZnkoeyBlbWFpbCwgcGFzc3dvcmQsIGZpcnN0TmFtZTogIkFkbWluIiwgbGFzdE5hbWU6ICJPd25lciIsIHRyYWNrRXZlbnRzOiBmYWxzZSwgbmV3c0xldHRlcjogZmFsc2UgfSk7CiAgICAgICAgY29uc3QgcyA9IGF3YWl0IGNhbGwoIi9hdXRoZW50aWNhdGlvbi9zaWduLXVwIiwgeyBtZXRob2Q6ICJQT1NUIiwgaGVhZGVyczogeyAiY29udGVudC10eXBlIjogImFwcGxpY2F0aW9uL2pzb24iIH0sIGJvZHkgfSk7CiAgICAgICAgaWYgKHMgJiYgcy5vaykgeyBjb25zb2xlLmxvZyhUQUcsICJwbGF0Zm9ybSBvd25lciBjcmVhdGVkIGZyb20gQVBfQURNSU5fRU1BSUwiKTsgY29udGludWU7IH0KICAgICAgICBjb25zb2xlLmVycm9yKFRBRywgIm93bmVyIHNpZ24tdXAgZmFpbGVkOiIsIHMgPyBzLnN0YXR1cyA6ICJubyByZXNwb25zZSIsIHMgPyAoYXdhaXQgcy50ZXh0KCkpLnNsaWNlKDAsIDMwMCkgOiAiIik7CiAgICAgIH0KICAgICAgd2FpdCA9IE1hdGgubWluKHdhaXQgKiAyLCAxNTAwMCk7CiAgICB9CiAgICBhd2FpdCBzbGVlcCh3YWl0KTsKICB9CiAgZnMud3JpdGVGaWxlU3luYyhNQVJLRVIsIEpTT04uc3RyaW5naWZ5KHsgcmVhZHk6IHRydWUgfSkpOwogIGNvbnNvbGUubG9nKFRBRywgIm93bmVyIHByZXNlbnQ7IGhlYWx0aGNoZWNrIG1hcmtlciB3cml0dGVuIik7Cn0pKCk7Cg== | base64 -d > /tmp/railway-bootstrap.js; node /tmp/railway-bootstrap.js & exec /usr/src/app/docker-entrypoint.sh'`
- **Health check:** /railway-ready.json
- **Public domain:** Yes

## Documentation

# Deploy and Host Activepieces Hardened on Railway

Activepieces is an open source automation platform, a self hosted alternative to Zapier and Make, with 600+ integrations (pieces), webhooks, schedules, AI agents and an MCP server. This template runs it with the owner account created at deploy time, Code steps sandboxed, and Postgres plus Redis included.

## About Hosting Activepieces Hardened

On a fresh Activepieces install the first person to open the sign-up page becomes the platform admin. This template closes that window: you enter your email at deploy, the container creates your account on loopback, and the healthcheck only passes after that, so the site never goes public unclaimed. Later sign-ups need an invitation. Code steps run in a V8 isolate (`SANDBOX_CODE_ONLY`) and flow code cannot reach private network addresses (`AP_NETWORK_MODE=STRICT`). The image is pinned to `0.92.3-hotfix.2`, which includes the October 2026 Node.js security update and the fix for an unauthenticated webhook crash.

## Common Use Cases

- Webhook and schedule driven automations between SaaS apps
- AI agents and MCP tools for Claude, Cursor and other clients
- Internal workflows with approvals, forms and tables

## Dependencies for Activepieces Hardened Hosting

- Postgres (`pgvector/pgvector:0.8.2-pg17`, included; pgvector enables the knowledge base feature)
- Redis (`redis:7.4.6-alpine`, included, persistent queue)

### Deployment Dependencies

- [Activepieces docs](https://www.activepieces.com/docs)
- [Sandboxing modes](https://www.activepieces.com/docs/install/architecture/sandboxing)
- [Environment variables](https://www.activepieces.com/docs/install/reference/environment-variables)

### What's included

| Service | Purpose |
|---------|---------|
| Activepieces | API, web UI and worker on port 8080 |
| Postgres | Flows, runs, users and files, on a volume |
| Redis | Job queue with AOF persistence, private only |

### First steps after deploy

1. Open the Activepieces domain.
2. Sign in with `AP_ADMIN_EMAIL` and the generated `AP_ADMIN_PASSWORD` (Activepieces service, Variables tab).
3. Change your password, then invite teammates from Platform Admin.
4. Build a flow. Webhook URLs look like `https:///api/v1/webhooks/`.

### Key environment variables

- `AP_ADMIN_EMAIL`: platform owner, the only value you enter.
- `AP_ADMIN_PASSWORD`: generated first login password, used on first boot only.
- `AP_EXECUTION_MODE`: `SANDBOX_CODE_ONLY` (default, no npm packages in Code steps) or `UNSANDBOXED` (npm allowed, only for fully trusted builders).
- `AP_NETWORK_MODE`: `STRICT` by default; allow private targets with `AP_SSRF_ALLOW_LIST`.
- `AP_FRONTEND_URL`: update after adding a custom domain.
- `AP_ENCRYPTION_KEY`: never change after first boot.

A Hobby plan or higher is recommended for the Activepieces service.

## Why Deploy Activepieces Hardened on Railway?

Railway is a singular platform to deploy your infrastructure stack. Railway will host your infrastructure so you don't have to deal with configuration, while allowing you to vertically and horizontally scale it.

By deploying Activepieces Hardened on Railway, you are one step closer to supporting a complete full stack application with minimal burden. Host your servers, databases, AI agents, and more on Railway.


## Similar templates

- [N8N Main + Worker](https://railway.com/deploy/n8n-main-worker) — Deploy and Host N8N with Inactive worker.
- [Evolution API with n8n](https://railway.com/deploy/evolution-api-with-n8n) — Automate WhatsApp workflows with Evolution API, n8n, and Postgres.
- [Postgres Backup](https://railway.com/deploy/postgres-s3-backups) — Cron-based PostgreSQL backup to bucket storage

Open this page in a browser: https://railway.com/deploy/activepieces-hardened-sandboxed