---
title: "Deploy OpenSearch | (Just Updated) It Boots, And Your Index Survives Redeploys"
description: "Single-node OpenSearch that boots, keeps its index, and needs a password"
category: "Storage"
url: https://railway.com/deploy/opensearch-or-just-updated-it-boots-and-
---

# Deploy OpenSearch | (Just Updated) It Boots, And Your Index Survives Redeploys

Single-node OpenSearch that boots, keeps its index, and needs a password

**[Deploy OpenSearch | (Just Updated) It Boots, And Your Index Survives Redeploys on Railway](https://railway.com/template/opensearch-or-just-updated-it-boots-and-)**

- **Creator:** SuperSlowSloth
- **Category:** Storage

## Template content

### opensearch https://opensearch.org/wp-content/uploads/2025/01/opensearch_logo_default.svg

- **Image:** ghcr.io/bon5co/opensearch-railway@sha256:37c828b0f49a76fcf880928b417fdb7661562ad67eeef700684fc0ec76d41820
- **Health check:** /_plugins/_security/health
- **Public domain:** Yes

## Documentation

# Deploy and Host OpenSearch on Railway

OpenSearch is the Apache-2.0 search and analytics engine forked from Elasticsearch 7.10 — a
distributed index for full-text search, log analytics, vector search and dashboards, with the
same REST API most Elasticsearch clients already speak.

This template runs a single node with its index on a Railway volume and its API behind HTTP
Basic authentication, generated fresh per deploy.

## About Hosting OpenSearch

OpenSearch does not run on Railway out of the box, and the fixes are not obvious:

- **Railway mounts volumes owned by root, while OpenSearch runs as an unprivileged user.** An
  unmodified image dies during startup with `AccessDeniedException` on its own data directory,
  before it ever serves a request. This template's entrypoint takes ownership of the volume as
  root and then hands the process to the `opensearch` user, which is required — OpenSearch
  refuses to run as root.
- **Railway terminates TLS at its edge and speaks plain HTTP to your container.** OpenSearch's
  security plugin defaults to HTTPS on the HTTP layer, so the edge cannot reach it. Here the
  plugin's transport encryption stays on and its HTTP-layer TLS is off, which is the shape
  Railway expects — authentication is untouched.
- **A search index on a public URL must not be anonymous.** The admin password is generated per
  deploy as a Railway secret, and the container refuses to start if it is ever unset rather than
  coming up as an open cluster.
- **Production bootstrap checks need privileges Railway does not grant.** `discovery.type` is set
  to `single-node`, which skips them, so no `memlock` or `nofile` ulimit changes and no
  `vm.max_map_count` sysctl are required.

The healthcheck points at `/_plugins/_security/health`, the one endpoint the security plugin
answers without credentials. Every other path returns `401 Unauthorized` to an anonymous caller.

**Memory:** the default heap is `-Xms512m -Xmx512m`, measured stable at roughly **900 MiB**
resident, so it fits Trial's 1 GB with little to spare and does not fit Free's 0.5 GB. Raise
`OPENSEARCH_JAVA_OPTS` and the plan together for real indexing volume — 2 GB is a comfortable
starting point.

## Why Deploy OpenSearch

- Apache 2.0 throughout, with no license change hanging over it and no paid tier gating security.
- The REST API is close enough to Elasticsearch 7 that most existing clients connect unchanged.
- Vector search, k-NN and hybrid search ship in the box, so a RAG index needs no extra service.
- Self-hosting keeps the index next to your app on Railway's private network instead of paying
  per-document to a managed search vendor.

## Common Use Cases

- Full-text search over an application's own catalogue, documents or user content.
- Log and event analytics — ship application logs in and query them without a SaaS bill.
- Vector and hybrid search for a RAG pipeline, using the built-in k-NN plugin.
- Metrics and observability storage behind OpenSearch Dashboards.

## Dependencies for OpenSearch

None. It is a single self-contained service.

### Deployment Dependencies

- A Railway volume, created by this template and mounted at `/usr/share/opensearch/data`.
- `OPENSEARCH_INITIAL_ADMIN_PASSWORD`, generated for you. Connect as user `admin` with that value.
- Source for the wrapper image: [bon5co/opensearch-railway](https://github.com/bon5co/opensearch-railway).


## Similar templates

- [Garage S3 Storage](https://railway.com/deploy/garage-s3-storage) — Ultra-light S3 server: fast, open-source, plug-and-play.
- [Redis](https://railway.com/deploy/redis-1) — Self Host Latest Redis with Railway
- [EasyImg](https://railway.com/deploy/easyimg) — Simple self-hostable Nuxt.js personal image hosting system.

Open this page in a browser: https://railway.com/deploy/opensearch-or-just-updated-it-boots-and-