Deploy and Host OpenSearch on Railway

OpenSearch is the Apache-2.0 search and analytics engine forked from Elasticsearch 7.10 — a distributed index for full-text search, log analytics, vector search and dashboards, with the same REST API most Elasticsearch clients already speak.

This template runs a single node with its index on a Railway volume and its API behind HTTP Basic authentication, generated fresh per deploy.

About Hosting OpenSearch

OpenSearch does not run on Railway out of the box, and the fixes are not obvious:

Railway mounts volumes owned by root, while OpenSearch runs as an unprivileged user. An unmodified image dies during startup with AccessDeniedException on its own data directory, before it ever serves a request. This template's entrypoint takes ownership of the volume as root and then hands the process to the opensearch user, which is required — OpenSearch refuses to run as root.
Railway terminates TLS at its edge and speaks plain HTTP to your container. OpenSearch's security plugin defaults to HTTPS on the HTTP layer, so the edge cannot reach it. Here the plugin's transport encryption stays on and its HTTP-layer TLS is off, which is the shape Railway expects — authentication is untouched.
A search index on a public URL must not be anonymous. The admin password is generated per deploy as a Railway secret, and the container refuses to start if it is ever unset rather than coming up as an open cluster.
Production bootstrap checks need privileges Railway does not grant. discovery.type is set to single-node, which skips them, so no memlock or nofile ulimit changes and no vm.max_map_count sysctl are required.

The healthcheck points at /_plugins/_security/health, the one endpoint the security plugin answers without credentials. Every other path returns 401 Unauthorized to an anonymous caller.

Memory: the default heap is -Xms512m -Xmx512m, measured stable at roughly 900 MiB resident, so it fits Trial's 1 GB with little to spare and does not fit Free's 0.5 GB. Raise OPENSEARCH_JAVA_OPTS and the plan together for real indexing volume — 2 GB is a comfortable starting point.

Why Deploy OpenSearch

Apache 2.0 throughout, with no license change hanging over it and no paid tier gating security.
The REST API is close enough to Elasticsearch 7 that most existing clients connect unchanged.
Vector search, k-NN and hybrid search ship in the box, so a RAG index needs no extra service.
Self-hosting keeps the index next to your app on Railway's private network instead of paying per-document to a managed search vendor.

Common Use Cases

Full-text search over an application's own catalogue, documents or user content.
Log and event analytics — ship application logs in and query them without a SaaS bill.
Vector and hybrid search for a RAG pipeline, using the built-in k-NN plugin.
Metrics and observability storage behind OpenSearch Dashboards.

Dependencies for OpenSearch

None. It is a single self-contained service.

Deployment Dependencies

A Railway volume, created by this template and mounted at /usr/share/opensearch/data.
OPENSEARCH_INITIAL_ADMIN_PASSWORD, generated for you. Connect as user admin with that value.
Source for the wrapper image: bon5co/opensearch-railway.