Deploy Kafka Native

Deploy and Host Kafka Native on Railway

Apache Kafka compiled with GraalVM (apache/kafka-native) and Kafbat Kafka UI 1.5.0. The native broker uses a few hundred megabytes of RAM instead of a full JVM heap. Kafbat is the maintained Kafka UI.

This is a single combined KRaft node. There is no ZooKeeper. The broker is reachable only on the private network. Kafka UI is public through a generated Railway domain on port 8080, and it has a generated login.

Apache marks the native image as experimental and intended for development and testing.

About Hosting Kafka Native

The broker image is apache/kafka-native:4.3.1. It runs as one process that is both broker and controller. A volume at /var/lib/kafka/data keeps topic logs across deploys. Logs live in /var/lib/kafka/data/kraft, one level below the mount, so Railway's lost+found directory does not stop Kafka from booting. The broker is limited to 0.5 vCPU and 512 MB.

Kafka UI uses ghcr.io/kafbat/kafka-ui:v1.5.0. It joins the broker over the private network. The UI is the only public service. Its heap is -Xms128m -Xmx384m inside a 1 GB limit, which is enough for it to finish starting.

Why Deploy Kafka Native

The GraalVM native binary starts quickly and stays small. A JVM Kafka image often wants a 1 GB heap before it serves traffic. This template is aimed at development, demos, and light internal workloads where that memory cost is the problem.

Railway private networking lets other services in the same project reach the broker without a public TCP port.

Common Use Cases

• Try Kafka from another Railway service without running ZooKeeper
• Inspect topics, messages, and consumer groups in the browser
• Prototype event-driven workers on a small single node

Dependencies for Kafka Native

Producers and consumers should run in the same Railway project. The broker does not authenticate clients. A public TCP proxy would expose every topic.

Deployment Dependencies

• apache/kafka-native:4.3.1
• ghcr.io/kafbat/kafka-ui:v1.5.0
• A volume mounted at /var/lib/kafka/data
• Private networking between the two services

Connect from another Railway service

KAFKA_BROKER_URL=${{Kafka.RAILWAY_PRIVATE_DOMAIN}}:9092
KAFKA_SECURITY_PROTOCOL=PLAINTEXT

UI login

Username admin. The password is generated on deploy as SPRING_SECURITY_USER_PASSWORD on the Kafka UI service.

Notes

• Replication factor is 1. Do not raise it on this single broker.
• CLUSTER_ID is generated once per deploy. Leave it unchanged after the first boot.
• Do not add a public TCP proxy. The listener is plaintext.