---
title: "Deploy dify 1.17"
description: "Deploy Dify 1.17 on Railway — LLM apps, RAG, agents, plugins, and workflows"
category: "AI/ML"
url: https://railway.com/deploy/dify-117
---

# Deploy dify 1.17

Deploy Dify 1.17 on Railway — LLM apps, RAG, agents, plugins, and workflows

**[Deploy dify 1.17 on Railway](https://railway.com/template/dify-117)**

- **Creator:** Sethumadhavan K's Projects
- **Category:** AI/ML

## Template content

### dify-api

- **Image:** langgenius/dify-api:1.17.0

### api-websocket

- **Image:** langgenius/dify-api:1.17.0
- **Health check:** /health

### postgres

- **Image:** postgres:15-alpine

### redis https://cdn.sanity.io/images/sy1jschh/production/0ce0bfdcfbdbf69662b1116671f97c2dd788b655-157x157.svg

- **Image:** redis:8.2
- **Start command:** `/bin/sh -c "rm -rf $RAILWAY_VOLUME_MOUNT_PATH/lost+found/ && exec docker-entrypoint.sh redis-server --requirepass $REDIS_PASSWORD --save 60 1 --dir $RAILWAY_VOLUME_MOUNT_PATH"`

### web

- **Image:** langgenius/dify-web:1.17.0

### local-sandbox

- **Image:** langgenius/dify-agent-local-sandbox:1.17.0
- **Health check:** /healthz

### worker-beat

- **Image:** langgenius/dify-api:1.17.0

### plugin-daemon

- **Image:** langgenius/dify-plugin-daemon:0.6.10-local

### weaviate

- **Image:** semitechnologies/weaviate:1.27.0

### ssrf-proxy

- **Image:** ghcr.io/sethumadhavan-k/dify-ssrf-proxy:1.17.0

### agent-backend

- **Image:** langgenius/dify-agent-backend:1.17.0

### sandbox

- **Image:** langgenius/dify-sandbox:0.2.15
- **Health check:** /health

### nginx

- **Image:** ghcr.io/sethumadhavan-k/dify-nginx:1.17.0
- **Health check:** /nginx-health
- **Public domain:** Yes

### minio

- **Image:** minio/minio:latest
- **Start command:** `minio server /data --console-address :9001`

### worker

- **Image:** langgenius/dify-api:1.17.0

### agent-ssrf-proxy

- **Image:** ghcr.io/sethumadhavan-k/dify-agent-ssrf-proxy:1.17.0

## Documentation

# Deploy and Host Dify on Railway

[Dify](https://dify.ai) is an open-source LLM app development platform with visual workflows, RAG pipelines, agents, and API management. This template deploys the full Dify 1.17 production stack on Railway.

## About Hosting Dify

Hosting Dify on Railway maps the official [Dify Docker Compose](https://docs.dify.ai/en/self-host/deploy/quick-start/docker-compose) stack to individual Railway services. Only **nginx** is public; everything else communicates over Railway's private network.

The stack includes:

- **nginx** — reverse proxy (custom image) for `/`, `/console/api`, `/api`, `/v1`, `/files`, `/socket.io`, `/e/` (plugin webhooks)
- **postgres** — PostgreSQL 15 for Dify and plugin metadata
- **redis** — managed Redis for cache and Celery
- **weaviate** — vector database for RAG knowledge bases
- **minio** — S3-compatible object storage (shared files across api/worker)
- **api** / **api-websocket** / **worker** / **worker-beat** — Dify backend (`langgenius/dify-api:1.17.0`)
- **web** — Dify frontend (`langgenius/dify-web:1.17.0`)
- **plugin-daemon** — Dify plugin runtime
- **agent-backend** / **local-sandbox** — Dify Agent shell workspaces
- **sandbox** / **ssrf-proxy** / **agent-ssrf-proxy** — secure code execution with SSRF protection

After deploy:

1. Generate a public domain on the **nginx** service (Settings → Networking).
2. Redeploy so `CONSOLE_API_URL`, `APP_API_URL`, and related URL variables resolve.
3. Open `https:///install` to create the admin account.
4. Add LLM provider API keys in **Settings → Model Providers**.

## Common Use Cases

- Self-hosted AI app builder with full data ownership
- RAG knowledge bases and agent workflows without SaaS lock-in
- Staging or demo Dify instance for team evaluation
- Plugin marketplace integration with outbound SSRF controls

### Publishing as a Railway template

All services use public Docker images (langgenius/* and GHCR gateway/SSRF images). Custom **nginx**, **ssrf-proxy**, and **agent-ssrf-proxy** images are built by GitHub Actions (`.github/workflows/publish-dify-images.yml`) and published to `ghcr.io/sethumadhavan-k/dify-*:1.17.0`.

After deploy, create the template:

```bash
railway templates create --project  --environment production
```

**Your template deploy URL:** https://railway.com/deploy/dify-117 (do not use `dify` — that slug is the official Railway template by Jack).

## Dependencies for Dify Hosting

- **Public domain on nginx** — Required for `CONSOLE_API_URL`, file URLs, and WebSocket endpoints
- **Public Docker images** — all services pull from Docker Hub / GHCR (no repo build required for template generation)
- **External LLM API keys** — Railway is CPU-only; inference uses OpenAI, Anthropic, or other providers you configure in Dify
- **Optional INIT_PASSWORD** — Protect the `/install` setup page on the **api** service

### Deployment Dependencies

- [Dify repository](https://github.com/langgenius/dify)
- [Dify self-host deploy overview](https://docs.dify.ai/en/self-host/deploy/overview)
- [Environment variables reference](https://docs.dify.ai/en/self-host/deploy/configuration/environments)
- [Railway Dify guide](https://docs.railway.com/guides/dify)

### Environment Variables (highlights)

| Variable | Service | Description |
|----------|---------|-------------|
| `SECRET_KEY` | api, worker | Auto-generated app secret — do not rotate after first deploy |
| `CONSOLE_API_URL` / `APP_API_URL` | api, worker, web | `https://${{nginx.RAILWAY_PUBLIC_DOMAIN}}` |
| `NEXT_PUBLIC_SOCKET_URL` | web | `wss://${{nginx.RAILWAY_PUBLIC_DOMAIN}}` |
| `S3_*` | api, worker | Wired to MinIO over the private network |
| `WEAVIATE_*` | api, worker, weaviate | Vector store for knowledge bases |
| `PLUGIN_DAEMON_KEY` | api, plugin-daemon | Plugin authentication key |
| `SANDBOX_API_KEY` | api, sandbox | Code execution sandbox key |
| `OPENAI_API_KEY` | api | Optional; configure providers in Dify UI instead |
| `INIT_PASSWORD` | dify-api | Optional; protect the `/install` setup page |

Optional integration variables (`OPENAI_API_KEY`, `OPENAI_API_BASE`, `SMTP_*`, `MAIL_TYPE`, `INIT_PASSWORD`) default to empty in [template.json](template.json) and can be left unset for a minimal deploy.

### Volumes

| Service | Mount path | Purpose |
|---------|------------|---------|
| postgres | `/var/lib/postgresql/data` | Database files |
| weaviate | `/var/lib/weaviate` | Vector index data |
| minio | `/data` | S3 object storage |
| plugin-daemon | `/app/storage` | Plugin packages and cache |
| sandbox | `/dependencies` | Sandbox Python dependencies (conf uses image defaults; Railway allows one volume per service) |
| local-sandbox | `/workspace` | Agent shell workspace (home dir is ephemeral) |

### Implementation Details

**Private network:** Backends are not exposed publicly. nginx proxies using `${{service.RAILWAY_PRIVATE_DOMAIN}}` and fixed container ports (API `5001`, Web `3000`, Plugin daemon `5002`).

**Shared storage:** Railway cannot share volumes across services. This template uses MinIO (S3-compatible) instead of local filesystem storage.

**Healthchecks:** nginx uses `/nginx-health` (local, does not wait on backends). **dify-api** and **api-websocket** use `/health` on port `5001` (set `PORT=5001` so Railway probes match `DIFY_PORT`). **sandbox** and **local-sandbox** set `PORT` to `8194` / `5004` for `/health` and `/healthz`.

**SSRF proxies:** Code sandbox and agent local sandbox egress route through dedicated Squid proxies, matching upstream Dify security architecture.

## Why Deploy Dify on Railway?

Railway hosts your full infrastructure stack on one platform — services, databases, volumes, and networking — so you can run a production-grade Dify instance without managing Docker Compose on a VM.

By deploying Dify on Railway, you get private service networking, persistent volumes, and one-click scaling while keeping full control of your data and LLM provider credentials.


## Similar templates

- [Chat Chat](https://railway.com/deploy/-WWW5r) — Chat Chat, your own unified chat and search to AI platform.
- [stella](https://railway.com/deploy/stella) — Self-host stella with web, API, Postgres, Redis, and object storage.
- [Hermes Agent | OpenClaw Alternative with Dashboard](https://railway.com/deploy/hermes-agent-or-openclaw-alternative-wit) — Self-Hosted Hermes AI Agent for Telegram, Discord & Slack

Open this page in a browser: https://railway.com/deploy/dify-117