---
title: "Deploy Elasticsearch | (Just Updated) v9 Search & Vector DB, Locked Down"
description: "Elasticsearch 9 search + vector DB. No anonymous reads, password resets."
category: "Storage"
url: https://railway.com/deploy/elasticsearch-or-just-updated-v9-search-
---

# Deploy Elasticsearch | (Just Updated) v9 Search & Vector DB, Locked Down

Elasticsearch 9 search + vector DB. No anonymous reads, password resets.

**[Deploy Elasticsearch | (Just Updated) v9 Search & Vector DB, Locked Down on Railway](https://railway.com/template/elasticsearch-or-just-updated-v9-search-)**

Machine-readable deploy manifest (JSON, validated by TemplateCI): https://railway.com/deploy/elasticsearch-or-just-updated-v9-search-/manifest.json

- **Creator:** SuperSlowSloth
- **Category:** Storage

## Template content

### elasticsearch

- **Image:** ghcr.io/bon5co/elasticsearch-railway@sha256:c7ee7e4eb04a78b22b2be03b46181816f712dbc9391d09125c00441b4253e358
- **Health check:** /
- **Public domain:** Yes

## Documentation

# Deploy and Host Elasticsearch on Railway

Elasticsearch is the distributed search and analytics engine behind the Elastic Stack: full-text
search, structured queries and aggregations, dense-vector (kNN) search for RAG and semantic
search, and log analytics, all over one REST API.

This template runs Elasticsearch 9.5.3 as a single node with its index on a Railway volume,
authentication on from the first boot, and a prebuilt, digest-pinned image, so a deploy starts in
seconds instead of building from source.

## About Hosting Elasticsearch

Elasticsearch runs on Railway only after a few things are handled for you:

- **Nothing is readable without a password.** Only `GET /` (name and version) answers anonymously,
  because Railway's healthcheck needs it. `_cluster/state`, `_nodes`, `_cat/*` and every index
  return `401`. A common Railway setup grants anonymous users the `monitor` privilege, which
  exposes every index name and its full field mapping through `_cluster/state`, plus the node's
  IP address and OS through `_nodes`, to anyone holding the URL.
- **Your password variable stays in charge.** Elasticsearch only reads `ELASTIC_PASSWORD` until
  the password is first changed through its API; after that, a stock deploy ignores the variable
  forever. Here the container checks it on every boot and re-applies it, so setting a new value
  and redeploying is a working password reset.
- **The volume is repaired, not worked around.** Railway mounts volumes owned by root while
  Elasticsearch refuses to run as root. The entrypoint takes ownership of the data directory and
  then hands the process to the unprivileged user.
- **Memory-mapped storage stays on.** mmap is Elasticsearch's fast path for index files and HNSW
  vector graphs. It is enabled whenever the host's `vm.max_map_count` allows it, which Railway's
  does.
- **The heap follows your plan.** No `-Xmx` is hard-coded, so Elasticsearch sizes its heap from
  the container's memory limit.
- **TLS is Railway's job.** Railway terminates HTTPS at its edge, so the node serves plain HTTP
  internally and binds IPv4 and IPv6, which makes it reachable from your other services over
  Railway's private network.

## Common Use Cases

- Full-text site and product search with relevance tuning, facets and autocomplete
- Vector and hybrid (BM25 + kNN) retrieval for RAG pipelines and AI agents
- Log and event analytics with aggregations
- A search backend for apps that already use an Elasticsearch client

## Dependencies for Elasticsearch Hosting

- One Railway volume for the index (created by the template)

### Deployment Dependencies

- Elasticsearch documentation: https://www.elastic.co/docs
- Wrapper source: https://github.com/bon5co/elasticsearch-railway

### Implementation Details

| Variable | Purpose |
| --- | --- |
| `ELASTIC_PASSWORD` | Password of the `elastic` superuser, generated per deploy. Change it and redeploy to reset. |
| `ELASTICSEARCH_URL` | Ready-made public URL with credentials, for clients outside Railway. |
| `ELASTICSEARCH_PRIVATE_URL` | Ready-made private-network URL, for services in the same project. |

Reference it from another service with `${{elasticsearch.ELASTICSEARCH_PRIVATE_URL}}`.

```bash
curl -u elastic:$ELASTIC_PASSWORD https:///_cluster/health
```

A single node keeps one copy of each shard, so a new index with the default one replica reports
`yellow` health. Create indices with `"number_of_replicas": 0` to see `green`.

## Why Deploy Elasticsearch on Railway?

Railway is a singular platform to deploy your infrastructure stack. Railway will host your
infrastructure so you don't have to deal with configuration, while allowing you to vertically and
horizontally scale it.

By deploying Elasticsearch on Railway, you are one step closer to supporting a complete full-stack
application with minimal burden. Host your servers, databases, AI agents, and more on Railway.


## Similar templates

- [Garage S3 Storage](https://railway.com/deploy/garage-s3-storage) — Ultra-light S3 server: fast, open-source, plug-and-play.
- [Redis](https://railway.com/deploy/redis-1) — Self Host Latest Redis with Railway
- [EasyImg](https://railway.com/deploy/easyimg) — Simple self-hostable Nuxt.js personal image hosting system.

Open this page in a browser: https://railway.com/deploy/elasticsearch-or-just-updated-v9-search-