Deploy and Host Kestra on Railway

Kestra is an open source, event driven orchestration platform. Workflows are declarative YAML files called flows: each one has an id, a namespace, a list of tasks, and optional inputs, triggers and error handlers. Kestra schedules them, runs them, keeps the full execution history, and exposes every UI action as a REST endpoint, so it works equally well as a scheduler, an ETL runner, or the control plane behind an internal API.

About Hosting Kestra

Hosting Kestra means running the standalone server next to PostgreSQL. Postgres holds the flow repository and the internal message queue; a persistent volume holds internal storage, which is where task outputs, namespace files, KV entries and auto installed plugins live. This template uses the official kestra/kestra:v2.0.2-slim image, pins PORT=8080 so Railway's healthcheck reaches /ping, points the JDBC datasource at a private Postgres service over Railway's internal network, and mounts a volume at /app/storage.

Two choices are worth calling out. First, basic auth is enabled by default with a generated password, so the instance is never briefly open on the public internet. Second, the template ships the slim image rather than the 3.2 GB image that bundles every plugin: Kestra's plugin auto install fetches what a flow actually needs from Maven Central on first use and caches it on the volume, which keeps deploys fast without limiting what you can build.

Common Use Cases

Scheduled data pipelines: cron style schedules with backfills, retries and SLA conditions
Event driven workflows: webhook triggers, flow triggers and polling triggers that start runs on external events
ETL and ELT orchestration: coordinate dbt, Snowflake, BigQuery, Postgres, S3 and Kafka steps in one flow
Internal automation APIs: expose a flow as an HTTP endpoint and let other services call it
An Airflow alternative: declarative YAML and a language agnostic API instead of Python DAG code

Dependencies for Kestra Hosting

PostgreSQL: required for the flow repository and the queue (included in this template)
A volume: required for internal storage and cached plugins (included, mounted at /app/storage)
No external API keys: Kestra boots with none, and needs none unless a flow uses a third party service
Outbound access to Maven Central: used only when a flow references a plugin that is not yet installed

Deployment Dependencies

Implementation Details

The image entrypoint writes KESTRA_CONFIGURATION to /app/confs/application.yml and hands it to Micronaut, so the whole server is configured from one variable that you can extend at any time.

PORT=8080
MICRONAUT_SERVER_PORT=${{PORT}}
KESTRA_ADMIN_USERNAME=admin@kestra.local
KESTRA_ADMIN_PASSWORD=Kestra1${{secret(24)}}
KESTRA_URL=https://${{RAILWAY_PUBLIC_DOMAIN}}/
RAILWAY_RUN_UID=0

After deploy, open the service domain and sign in with KESTRA_ADMIN_USERNAME and KESTRA_ADMIN_PASSWORD. The username has to stay in email form and the password needs at least eight characters with an uppercase letter, a lowercase letter and a digit, because Kestra validates both. From there you can write a flow in the editor or push one with POST /api/v1/main/flows using Content-Type: application/x-yaml. The open source tenant is always called main, which is why it appears in every API path.

One Railway specific note: Kestra's script tasks (io.kestra.plugin.scripts.*) default to the Docker task runner, and Railway does not expose a Docker socket. Add taskRunner: {type: io.kestra.plugin.core.runner.Process} to those tasks and they run inside the Kestra container instead. Every other task type, including all core tasks, triggers, schedules, subflows and the JVM based integration plugins, works without any change.

Why Deploy Kestra on Railway?

Railway is a singular platform to deploy your infrastructure stack. Railway will host your infrastructure so you don't have to deal with configuration, while allowing you to vertically and horizontally scale it.

By deploying Kestra on Railway, you get a pre-configured orchestration platform with Postgres, persistent internal storage, a generated admin password, health checks, managed SSL, and private networking to the rest of your services.