Deploy and Host CockroachDB on Railway

CockroachDB is a distributed SQL database that speaks the PostgreSQL wire protocol, so existing drivers and ORMs connect to it unchanged. This template runs CockroachDB as a single secure node from a digest-pinned official image, with TLS enabled from the first boot, a generated SQL password and a persistent volume.

About Hosting CockroachDB

CockroachDB needs several things handled for Railway, all done in the start command:

Secure mode, not insecure mode. The node generates its own certificate authority and node certificate on first boot and stores them on the volume. The certificate covers the TCP proxy and private hostnames, so sslmode=require works from outside and inside the project.
A real SQL user. An app user with the admin role is created on every boot with the password in CRDB_PASSWORD, which is generated per deploy. No default credential is ever live on a public address. A database named app is created for you.
Writable volume. Railway mounts volumes root-owned, so the service runs as root and logs the owner of the data directory at boot.
Data directory under the mount. The store lives in a subdirectory of /cockroach/cockroach-data, so the volume's lost+found never lands in the store.
Wire protocol. Clients connect over a TCP proxy on port 26257. There is no HTTP healthcheck, because a TCP proxy and an HTTP healthcheck cannot share one service on Railway.
Memory. Cache and SQL memory are capped at a quarter of memory each.

The DB Console is not exposed on a public domain: Railway's edge forwards plain HTTP, and a secure CockroachDB node answers plain HTTP with a redirect to itself, so a public domain would loop forever. Use SQL, or reach the console over the project's private network.

Why Deploy

Secure from the first boot: TLS on, password generated, no insecure flag
Connection strings preset as variables: CRDB_DSN (public) and CRDB_PRIVATE_DSN (private)
Data and certificates survive redeploys
PostgreSQL-compatible, so existing drivers and ORMs work

Common Use Cases

Application database for services that need PostgreSQL compatibility with a path to scale-out
Development and staging copy of a CockroachDB production cluster
Trying CockroachDB SQL features such as multi-region schemas and serializable transactions
Self-hosted alternative to CockroachDB Cloud for small workloads

Dependencies for CockroachDB Hosting

None. CockroachDB runs as one service with a volume at /cockroach/cockroach-data.

Deployment Dependencies

CockroachDB: https://github.com/cockroachdb/cockroach
Documentation: https://www.cockroachlabs.com/docs/
Official image: https://hub.docker.com/r/cockroachdb/cockroach

Implementation Details

Variable	Purpose
`CRDB_PASSWORD`	Password for the `app` user, generated per deploy.
`CRDB_DSN`	Public connection string through the TCP proxy.
`CRDB_PRIVATE_DSN`	Private connection string for services in the same Railway project.

Connect with cockroach sql --url "$CRDB_DSN" or any PostgreSQL client, using sslmode=require.

Why Deploy CockroachDB on Railway?

Railway is a singular platform to deploy your infrastructure stack. Railway will host your infrastructure so you don't have to deal with configuration, while allowing you to vertically and horizontally scale it.

By deploying CockroachDB on Railway, you are one step closer to supporting a complete full-stack application with minimal burden. Host your servers, databases, AI agents, and more on Railway.