--- title: "Deploy Dify · Quick Start" description: "Open-source LLM app and agent platform with workflows, RAG and plugins" category: "AI/ML" url: https://railway.com/deploy/dify-quick-start --- # Deploy Dify · Quick Start Open-source LLM app and agent platform with workflows, RAG and plugins **[Deploy Dify · Quick Start on Railway](https://railway.com/template/dify-quick-start)** Machine-readable deploy manifest (JSON, validated by TemplateCI): https://railway.com/deploy/dify-quick-start/manifest.json - **Creator:** withSeismic - **Category:** AI/ML ## Template content ### Agent-Sandbox - **Image:** langgenius/dify-agent-local-sandbox:latest - **Start command:** `/usr/bin/tini -g -- /bin/bash -c '[ "$(stat -c %U /home/dify)" = dify ] || chown -R dify:dify /home/dify; exec setpriv --reuid=dify --regid=dify --init-groups shellctl serve --listen [::]:5004 --require-auth-token'` - **Health check:** /healthz ### Redis https://cdn.sanity.io/images/sy1jschh/production/0ce0bfdcfbdbf69662b1116671f97c2dd788b655-157x157.svg - **Image:** redis:8.2 - **Start command:** `/bin/sh -c "rm -rf $RAILWAY_VOLUME_MOUNT_PATH/lost+found/ && exec docker-entrypoint.sh redis-server --requirepass $REDIS_PASSWORD --save 60 1 --dir $RAILWAY_VOLUME_MOUNT_PATH"` ### Worker-Beat - **Image:** langgenius/dify-api:latest ### Worker - **Image:** langgenius/dify-api:latest ### Web - **Image:** langgenius/dify-web:latest - **Health check:** /signin ### Postgres - **Image:** pgvector/pgvector:pg18 - **Start command:** `docker-entrypoint.sh postgres -c max_connections=200` ### Sandbox - **Image:** langgenius/dify-sandbox:latest - **Health check:** /health ### Agent-Backend - **Image:** langgenius/dify-agent-backend:latest - **Start command:** `python -c "import os,socket; s=socket.socket(socket.AF_INET6, socket.SOCK_STREAM); s.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1); s.setsockopt(socket.IPPROTO_IPV6, socket.IPV6_V6ONLY, 0); s.bind(('::', 5050)); os.set_inheritable(s.fileno(), True); os.execvp('uvicorn', ['uvicorn', 'dify_agent.server.app:app', '--fd', str(s.fileno())])"` - **Health check:** /docs ### SSRF-Proxy - **Image:** ubuntu/squid:latest - **Start command:** `/bin/bash -c 'printf "%s\n" "$SQUID_CONF" > /etc/squid/squid.conf && exec /usr/local/bin/entrypoint.sh -f /etc/squid/squid.conf -NYC'` ### Dify - **Image:** caddy:latest - **Start command:** `sh -c 'printf "%s\n" "$CADDYFILE" > /etc/caddy/Caddyfile && exec caddy run --config /etc/caddy/Caddyfile --adapter caddyfile'` - **Health check:** /healthz - **Public domain:** Yes ### API - **Image:** langgenius/dify-api:latest - **Start command:** `/bin/bash -c 'if [ -n "$ADMIN_EMAIL" ]; then ( u=http://localhost:5001/console/api; for i in $(seq 1 180); do s=$(curl -fsS $u/setup 2>/dev/null) && break; sleep 5; done; case "$s" in *not_started*) c=$(mktemp); if curl -fsS -c $c -b $c -H "Content-Type: application/json" -d "{\"password\":\"$INIT_PASSWORD\"}" $u/init >/dev/null && curl -fsS -c $c -b $c -H "Content-Type: application/json" -d "{\"email\":\"$ADMIN_EMAIL\",\"name\":\"Admin\",\"password\":\"$ADMIN_PASSWORD\"}" $u/setup >/dev/null; then echo "dify-seed: created admin account $ADMIN_EMAIL"; else echo "dify-seed: admin setup failed; finish setup at /install with INIT_PASSWORD"; fi; rm -f $c;; *finished*) echo "dify-seed: setup already finished, skipping";; esac ) & fi; exec /bin/bash /entrypoint.sh'` - **Health check:** /health ### Plugin-Daemon - **Image:** langgenius/dify-plugin-daemon:latest-local - **Start command:** `/usr/bin/tini -g -- /bin/bash -c '[ "$(stat -c %U /app/storage)" = dify ] || chown -R dify:dify /app/storage; exec setpriv --reuid=dify --regid=dify --init-groups /bin/bash -c "/app/commandline migrate && exec /app/main"'` - **Health check:** /health/check ## Buckets - **dify-files** ## Documentation # Deploy and Host Dify on Railway Dify is an open-source platform for building LLM apps: chatbots, agents, RAG over your own documents, and visual workflows, with a published API for each app. This template runs the full self-hosted stack from Dify's official `docker-compose.yaml` on Railway. It uses the official images, closes public sign-up, creates your admin account on first start and keeps everything on the private network except one HTTPS domain. ## About Hosting Dify - **The complete upstream stack.** API, Celery worker, Celery beat, web console, code sandbox, plugin daemon, agent backend, agent sandbox and SSRF proxy. These are the same services and settings as upstream `docker/docker-compose.yaml`, with a small Caddy router in place of nginx using the same routes. - **One public domain.** The router is the only service with a domain. The console, `/console/api`, `/api`, `/v1` (Service API), `/files`, `/mcp`, `/triggers`, `/socket.io` and plugin endpoints (`/e/...`) all share one origin, so Dify's cookie login works without cross-site settings. Every other service talks over `*.railway.internal`. - **No default login.** The admin account is created from `ADMIN_EMAIL` with a generated password. `/install` is locked by a generated `INIT_PASSWORD`, and public sign-up and workspace creation are off. - **All secrets generated.** These include `SECRET_KEY`, the plugin daemon key, the inner API key, the sandbox key, the agent tokens and the Postgres and Redis passwords. They are stored as variables, so they survive redeploys. - **Outbound traffic is filtered.** HTTP requests from workflows, the code sandbox and the agent sandbox go through Squid, which blocks private, loopback, link-local and cloud-metadata addresses. Plugin signature checks are on, so only marketplace-signed plugins install. - **Durable storage.** - Postgres with pgvector holds metadata, knowledge-base vectors and the plugin database, on a volume. - Redis runs on a volume. - Uploads and tenant encryption keys go to a Railway bucket (S3). - Installed plugins and the agent sandbox home have their own volumes. - **Tracks upstream.** Images use `:latest` (the plugin daemon uses `latest-local`), and database migrations run automatically when the API starts. ### Getting started 1. Enter `ADMIN_EMAIL` (the only input) and deploy. The first start takes a few minutes while the API runs database migrations. 2. Open the **API** service, then **Variables**, and copy `ADMIN_PASSWORD`. 3. Open the **Dify** service's public URL and sign in with `ADMIN_EMAIL` and `ADMIN_PASSWORD`. Change the password under **Settings → Account**. 4. Go to **Settings → Model Provider**, install a provider plugin from the marketplace (OpenAI, Anthropic, Gemini, Ollama, …) and add your API key. 5. In **Studio**, create an app (chatbot, agent or workflow), test it, publish it, and call it through the Service API at `https://YOUR_DOMAIN/v1` with an app API key. 6. If you left `ADMIN_EMAIL` empty, open `https://YOUR_DOMAIN/install`, enter `INIT_PASSWORD` from the API service's variables and create the admin there. ## Common Use Cases - Chat assistants that answer from your own documents (knowledge bases with pgvector retrieval). - Workflow automation that mixes LLM steps, Python and JavaScript code nodes, HTTP requests and tools. - Agents that call marketplace plugins and tools, or your own APIs. - A backend for LLM features in your product, using each app's REST API and API keys. - Comparing model providers and prompts in one place before shipping. ## Dependencies for Dify Hosting - PostgreSQL with the pgvector extension (metadata, vectors and the plugin database) - Redis (cache, locks and the Celery broker) - S3-compatible object storage (a Railway bucket) ### Deployment Dependencies - Dify source and compose file: https://github.com/langgenius/dify/tree/main/docker - Dify self-hosting docs: https://docs.dify.ai/en/self-host/quick-start/docker-compose - Environment variable reference: https://docs.dify.ai/en/self-host/configuration/environments - Official images: https://hub.docker.com/u/langgenius - Plugin marketplace: https://marketplace.dify.ai - Railway buckets: https://docs.railway.com/storage-buckets - Railway private networking: https://docs.railway.com/networking/private-networking ### Implementation Details | Service | Image | Role | |---|---|---| | Dify | `caddy:latest` | Public router on port 8080, with the same routes as upstream nginx. Healthcheck `/healthz` | | API | `langgenius/dify-api:latest` | Console and Service API. Runs migrations and seeds the admin. Serves Socket.IO for collaboration. Healthcheck `/health` | | Worker | `langgenius/dify-api:latest` | Celery worker for indexing, workflows, mail and cleanup | | Worker-Beat | `langgenius/dify-api:latest` | Celery beat scheduler | | Web | `langgenius/dify-web:latest` | Next.js console. Healthcheck `/signin` | | Plugin-Daemon | `langgenius/dify-plugin-daemon:latest-local` | Installs and runs plugins. Volume `/app/storage`. Healthcheck `/health/check` | | Sandbox | `langgenius/dify-sandbox:latest` | Runs code nodes. Healthcheck `/health` | | SSRF-Proxy | `ubuntu/squid:latest` | Outbound proxy that blocks private and metadata addresses | | Agent-Backend | `langgenius/dify-agent-backend:latest` | Agent v2 runtime. Healthcheck `/docs` | | Agent-Sandbox | `langgenius/dify-agent-local-sandbox:latest` | Shell sandbox for agent tools. Volume `/home/dify`. Healthcheck `/healthz` | | Postgres | `pgvector/pgvector:pg18` | Databases `dify` and `dify_plugin`, with pgvector. Volume `/var/lib/postgresql/data` | | Redis | `redis:8.2` | Cache and broker. Volume `/data` | | dify-files (bucket) | Railway bucket | Uploads, generated files and tenant keys | | Variable | Service | Purpose | |---|---|---| | `ADMIN_EMAIL` | API | The only input. The admin account created on first start. Leave empty to use `/install` instead | | `ADMIN_PASSWORD` | API | Generated admin password, used only when the admin is created | | `INIT_PASSWORD` | API | Generated password that guards `/install` | | `SECRET_KEY` | API | Signs sessions and encrypts stored credentials. Never change it after the first deploy | | `DIFY_PUBLIC_HOST` | Dify | The public host name. Every service builds its URLs from it | | `SERVER_KEY` | Plugin-Daemon | Key the API and agent backend use to call the plugin daemon | | `INNER_API_KEY_FOR_PLUGIN` | API | Key the plugin daemon and agent backend use to call back into the API | | `API_KEY` | Sandbox | Key for the code sandbox | | `DIFY_AGENT_API_TOKEN`, `DIFY_AGENT_SERVER_SECRET_KEY` | Agent-Backend | Agent backend token and stub signing key | | `SHELLCTL_AUTH_TOKEN` | Agent-Sandbox | Token for the agent sandbox | | `SQUID_CONF`, `CADDYFILE` | SSRF-Proxy, Dify | Proxy and router configs, written to disk at start | **Custom domain:** add the domain to the **Dify** service (target port 8080), set `DIFY_PUBLIC_HOST` on that service to the new host name, then redeploy API, Worker and Web so they pick up the new URL. **Email:** password reset, invitations and email login need a mail provider. Set `MAIL_TYPE` (`resend` or `smtp`) and its variables on API and Worker, as described in Dify's environment docs. **Upgrades:** the services pull `:latest` on every deploy. To upgrade, redeploy **API** first, because it runs migrations, then the other `dify-*` services. Back up Postgres before a major Dify release. To pin a version, change the image tag on API, Worker, Worker-Beat, Web, Sandbox and the agent services to the same release (for example `1.19.0`). Pin the plugin daemon to its matching `-local` tag. Keep `SECRET_KEY` and the bucket. Without them, stored model credentials can't be decrypted. ## Why Deploy Dify on Railway? Railway is a singular platform to deploy your infrastructure stack. Railway will host your infrastructure so you don't have to deal with configuration, while allowing you to vertically and horizontally scale it. By deploying Dify on Railway, you are one step closer to supporting a complete full-stack application with minimal burden. Host your servers, databases, AI agents, and more on Railway. ## Similar templates - [Chat Chat](https://railway.com/deploy/-WWW5r) — Chat Chat, your own unified chat and search to AI platform. - [Weaviate](https://railway.com/deploy/weaviate-1) — Vector database with hybrid search and an API key-protected API - [Möbius Personal AI OS](https://railway.com/deploy/mobius-v01-personal-ai-os) — Self-hosted AI agent that builds and runs apps for you, with memory. Open this page in a browser: https://railway.com/deploy/dify-quick-start