Deploy dify 1.17

Deploy and Host Dify on Railway

Dify is an open-source LLM app development platform with visual workflows, RAG pipelines, agents, and API management. This template deploys the full Dify 1.17 production stack on Railway.

About Hosting Dify

Hosting Dify on Railway maps the official Dify Docker Compose stack to individual Railway services. Only nginx is public; everything else communicates over Railway's private network.

The stack includes:

• nginx — reverse proxy (custom image) for /, /console/api, /api, /v1, /files, /socket.io, /e/ (plugin webhooks)
• postgres — PostgreSQL 15 for Dify and plugin metadata
• redis — managed Redis for cache and Celery
• weaviate — vector database for RAG knowledge bases
• minio — S3-compatible object storage (shared files across api/worker)
• api / api-websocket / worker / worker-beat — Dify backend (langgenius/dify-api:1.17.0)
• web — Dify frontend (langgenius/dify-web:1.17.0)
• plugin-daemon — Dify plugin runtime
• agent-backend / local-sandbox — Dify Agent shell workspaces
• sandbox / ssrf-proxy / agent-ssrf-proxy — secure code execution with SSRF protection

After deploy:

1. Generate a public domain on the nginx service (Settings → Networking).
2. Redeploy so CONSOLE_API_URL, APP_API_URL, and related URL variables resolve.
3. Open https:///install to create the admin account.
4. Add LLM provider API keys in Settings → Model Providers.

Common Use Cases

• Self-hosted AI app builder with full data ownership
• RAG knowledge bases and agent workflows without SaaS lock-in
• Staging or demo Dify instance for team evaluation
• Plugin marketplace integration with outbound SSRF controls

Publishing as a Railway template

All services use public Docker images (langgenius/* and GHCR gateway/SSRF images). Custom nginx, ssrf-proxy, and agent-ssrf-proxy images are built by GitHub Actions (.github/workflows/publish-dify-images.yml) and published to ghcr.io/sethumadhavan-k/dify-*:1.17.0.

After deploy, create the template:

railway templates create --project  --environment production

Your template deploy URL: https://railway.com/deploy/dify-117 (do not use dify — that slug is the official Railway template by Jack).

Dependencies for Dify Hosting

• Public domain on nginx — Required for CONSOLE_API_URL, file URLs, and WebSocket endpoints
• Public Docker images — all services pull from Docker Hub / GHCR (no repo build required for template generation)
• External LLM API keys — Railway is CPU-only; inference uses OpenAI, Anthropic, or other providers you configure in Dify
• Optional INIT_PASSWORD — Protect the /install setup page on the api service

Deployment Dependencies

• Dify repository
• Dify self-host deploy overview
• Environment variables reference
• Railway Dify guide

Environment Variables (highlights)

Optional integration variables (OPENAI_API_KEY, OPENAI_API_BASE, SMTP_*, MAIL_TYPE, INIT_PASSWORD) default to empty in template.json and can be left unset for a minimal deploy.

Volumes

Implementation Details

Private network: Backends are not exposed publicly. nginx proxies using ${{service.RAILWAY_PRIVATE_DOMAIN}} and fixed container ports (API 5001, Web 3000, Plugin daemon 5002).

Shared storage: Railway cannot share volumes across services. This template uses MinIO (S3-compatible) instead of local filesystem storage.

Healthchecks: nginx uses /nginx-health (local, does not wait on backends). dify-api and api-websocket use /health on port 5001 (set PORT=5001 so Railway probes match DIFY_PORT). sandbox and local-sandbox set PORT to 8194 / 5004 for /health and /healthz.

SSRF proxies: Code sandbox and agent local sandbox egress route through dedicated Squid proxies, matching upstream Dify security architecture.

Why Deploy Dify on Railway?

Railway hosts your full infrastructure stack on one platform — services, databases, volumes, and networking — so you can run a production-grade Dify instance without managing Docker Compose on a VM.

By deploying Dify on Railway, you get private service networking, persistent volumes, and one-click scaling while keeping full control of your data and LLM provider credentials.