Deploy Renovate

Deploy and Host Renovate on Railway

Renovate is the open-source dependency bot from Mend.io. It reads the manifests and lock files in your repositories, works out which dependencies have newer versions, and opens pull requests that bump them — one per dependency, or grouped however you like. It understands more than ninety package managers, so one bot covers package.json, go.mod, Dockerfiles, Helm charts and GitHub Actions workflows in the same repository. Self-host Renovate to point it at private repositories or a self-managed GitLab or Gitea, and to keep its schedule under your control.

Deploy Renovate on Railway and it runs as a scheduled worker rather than a one-shot command you drive yourself. The template provisions a renovate service running the bot on a loop behind a password-protected status dashboard, a Redis service holding the global lookup cache so repeated version checks do not re-query npm and Docker Hub every pass, and an object storage bucket for each repository's extracted dependency state. A 5 GB volume keeps Git clones warm between runs.

Getting Started with Renovate on Railway

Open the public URL once the deploy finishes. The dashboard uses HTTP basic auth: username admin, password the generated STATUS_PASSWORD from the renovate service's Variables tab. With no platform credential yet, the bot does not sit idle — it runs a built-in self-test, a real dry run against an outdated sample project inside the image, showing the dependencies it found and the updates available. That confirms the engine, the version lookups and both caches work before any token is involved.

To point it at your own code, create a credential on your Git platform — on GitHub, a classic personal access token with the repo scope, a fine-grained token with read and write on contents, pull requests and issues, or an installation token from your own GitHub App. Paste it into RENOVATE_TOKEN; Railway redeploys and the next run starts immediately. The bot discovers every repository the token can see unless you name them in RENOVATE_REPOSITORIES. In each one it first opens an onboarding pull request titled Configure Renovate; merge that and real update pull requests follow, plus a Dependency Dashboard issue tracking what is outstanding.

About Hosting Renovate

Dependency upgrades are individually trivial and collectively enormous. Left alone, a service drifts until upgrading anything means upgrading everything at once. Renovate turns that into a steady stream of small, reviewable pull requests, each carrying a changelog and your own CI results.

Key capabilities:

• Ninety-plus managers: npm, pnpm, Yarn, pip, Poetry, uv, Go modules, Maven, Gradle, Bundler, Composer, NuGet, Cargo, Docker, Helm, Terraform, Actions
• Works with GitHub, GitLab, Bitbucket, Azure DevOps, Gitea, Forgejo and Gerrit
• Grouping, scheduling, automerge, and separate handling of major versus minor updates
• A Dependency Dashboard issue listing every pending and errored update
• Shareable presets so many repositories inherit one policy, plus lock file maintenance

The renovate service is the bot, on a timer set by RENOVATE_INTERVAL_SECONDS and defaulting to the hourly cadence upstream recommends. Redis holds the global lookup cache — the answers to "what versions of this package exist" — shared across every repository and run. The bucket holds each repository's extracted dependencies, so repeat runs skip parsing they already did.

Why Deploy Renovate on Railway

Railway removes the scheduling and storage plumbing self-hosted Renovate needs.

• Redis and object storage provisioned and wired up, no connection strings to write
• The bot runs on a loop with automatic restarts, so no external cron is required
• A persistent volume keeps Git clones and caches warm between runs
• A status dashboard and health check ship with the deploy

Common Use Cases

• Keeping a private monorepo's npm, Docker and Actions dependencies current without giving a hosted bot access to the code
• Running dependency automation against a self-managed GitLab, Gitea or Forgejo
• Enforcing one upgrade policy across dozens of repositories through a shared preset
• Getting security patches proposed as pull requests within the hour

Dependencies for Renovate

• Renovate worker — gridalpha/renovate-railway, built on the official renovate/renovate image. Runs the bot, serves the dashboard.
• Redis (redis:8.2) — global lookup cache for versions and changelogs. Private only.
• Object storage bucket — S3-backed cache of extracted dependency state.

Environment Variables Reference

Deployment Dependencies

• Source repo: gridalpha/renovate-railway
• Upstream and docs: renovatebot/renovate, docs.renovatebot.com

Hardware Requirements for Self-Hosting Renovate

Memory is what matters: Renovate clones repositories and runs the real package manager to refresh lock files, so large builds need headroom.

Self-Hosting Renovate with Docker

Renovate ships as a container that runs once and exits, which is why a scheduler is part of any real deployment. A single run against two repositories:

docker run --rm \
  -e RENOVATE_TOKEN=your_token_here \
  -e RENOVATE_PLATFORM=github \
  renovate/renovate:latest \
  your-org/repo-one your-org/repo-two

To discover everything the token can see and cache lookups in Redis between runs:

docker run --rm \
  -e RENOVATE_TOKEN=your_token_here \
  -e RENOVATE_AUTODISCOVER=true \
  -e RENOVATE_REDIS_URL=redis://redis:6379 \
  -e RENOVATE_REPOSITORY_CACHE=enabled \
  -v renovate-data:/tmp/renovate \
  renovate/renovate:latest

Every self-hosted option has an environment variable form: camelCase becomes RENOVATE_ plus upper snake case, so repositoryCacheType is RENOVATE_REPOSITORY_CACHE_TYPE.

How Much Does Renovate Cost to Self-Host?

Renovate is free and open source under AGPL-3.0, with no paid tier and no per-repository charge for the self-hosted bot. Mend.io sells a separate hosted product, but the CLI and image used here are the complete tool. On Railway you pay only for infrastructure — a bot watching a handful of repositories hourly is mostly idle.

Renovate vs Dependabot

Dependabot is the lower-effort choice inside GitHub; Renovate wins when repositories live elsewhere or one policy must cover many of them.

FAQ

What is Renovate? An open-source bot that scans repositories for outdated dependencies and opens pull requests to update them, across ninety-plus package managers and several Git platforms.

What does this Railway template deploy? A Renovate worker running the bot on a schedule behind a password-protected status dashboard, a Redis service for the global lookup cache, an object storage bucket for the per-repository cache, and a persistent volume for Git clones.

Why does this template include Redis and object storage? Renovate re-checks the same packages across every repository and run. Redis holds those version lookups so registries are not queried repeatedly; the bucket holds extracted dependency state so repeat runs skip work already done.

How do I create the token for self-hosted Renovate on GitHub? A classic personal access token with the repo scope works; a fine-grained token needs read and write on contents, pull requests and issues. For an organisation, register a GitHub App and pass an installation token, so pull requests come from a bot identity.

How often does Renovate run, and can I change it? Hourly by default. Set RENOVATE_INTERVAL_SECONDS to change it, with a 60-second floor, or use Renovate's schedule option in renovate.json to confine updates to weekday mornings.

Can I preview what Renovate would do before it opens pull requests? Set RENOVATE_DRY_RUN to lookup. The bot runs the full scan and logs every pull request it would have created, without touching your repositories.