---
title: "Deploy Renovate"
description: "Bot that opens pull requests to update your dependencies"
category: "Automation"
url: https://railway.com/deploy/renovate
---

# Deploy Renovate

Bot that opens pull requests to update your dependencies

**[Deploy Renovate on Railway](https://railway.com/template/renovate)**

- **Creator:** A3A
- **Category:** Automation

## Template content

### renovate https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons/svg/renovate.svg

- **Source:** https://github.com/gridalpha/renovate-railway
- **Public domain:** Yes

### Redis https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons/svg/redis.svg

- **Image:** redis:8.2
- **Start command:** `/bin/sh -c "rm -rf $RAILWAY_VOLUME_MOUNT_PATH/lost+found/ && exec docker-entrypoint.sh redis-server --requirepass $REDIS_PASSWORD --save 60 1 --dir $RAILWAY_VOLUME_MOUNT_PATH"`

## Buckets

- **renovate-cache**

## Documentation

![Renovate logo](https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcQ6rZy7IeKhVb5H_65CAcNpUIxnjmbZw86NBRM7DB1LHQ&s=10)

# Deploy and Host Renovate on Railway

Renovate is the open-source dependency bot from Mend.io. It reads the manifests and lock files in your repositories, works out which dependencies have newer versions, and opens pull requests that bump them — one per dependency, or grouped however you like. It understands more than ninety package managers, so one bot covers `package.json`, `go.mod`, Dockerfiles, Helm charts and GitHub Actions workflows in the same repository. Self-host Renovate to point it at private repositories or a self-managed GitLab or Gitea, and to keep its schedule under your control.

Deploy Renovate on Railway and it runs as a scheduled worker rather than a one-shot command you drive yourself. The template provisions a `renovate` service running the bot on a loop behind a password-protected status dashboard, a Redis service holding the global lookup cache so repeated version checks do not re-query npm and Docker Hub every pass, and an object storage bucket for each repository's extracted dependency state. A 5 GB volume keeps Git clones warm between runs.

![Diagram of the Renovate worker connected to Redis on Railway](https://res.cloudinary.com/rroe4rtk/image/upload/v1787812423/renovate-architecture.png)

## Getting Started with Renovate on Railway

Open the public URL once the deploy finishes. The dashboard uses HTTP basic auth: username `admin`, password the generated `STATUS_PASSWORD` from the `renovate` service's Variables tab. With no platform credential yet, the bot does not sit idle — it runs a built-in self-test, a real dry run against an outdated sample project inside the image, showing the dependencies it found and the updates available. That confirms the engine, the version lookups and both caches work before any token is involved.

To point it at your own code, create a credential on your Git platform — on GitHub, a classic personal access token with the `repo` scope, a fine-grained token with read and write on contents, pull requests and issues, or an installation token from your own GitHub App. Paste it into `RENOVATE_TOKEN`; Railway redeploys and the next run starts immediately. The bot discovers every repository the token can see unless you name them in `RENOVATE_REPOSITORIES`. In each one it first opens an onboarding pull request titled *Configure Renovate*; merge that and real update pull requests follow, plus a Dependency Dashboard issue tracking what is outstanding.

![Renovate status dashboard showing worker phase, caches and self-test totals](https://res.cloudinary.com/rroe4rtk/image/upload/v1787812433/renovate-dashboard.png)

![Table of dependency updates Renovate found across npm and Docker](https://res.cloudinary.com/rroe4rtk/image/upload/v1787812435/renovate-pending-updates.png)

![Renovate run log with dependency extraction statistics per manager](https://res.cloudinary.com/rroe4rtk/image/upload/v1787812437/renovate-selftest-log.png)

## About Hosting Renovate

Dependency upgrades are individually trivial and collectively enormous. Left alone, a service drifts until upgrading anything means upgrading everything at once. Renovate turns that into a steady stream of small, reviewable pull requests, each carrying a changelog and your own CI results.

Key capabilities:

- Ninety-plus managers: npm, pnpm, Yarn, pip, Poetry, uv, Go modules, Maven, Gradle, Bundler, Composer, NuGet, Cargo, Docker, Helm, Terraform, Actions
- Works with GitHub, GitLab, Bitbucket, Azure DevOps, Gitea, Forgejo and Gerrit
- Grouping, scheduling, automerge, and separate handling of major versus minor updates
- A Dependency Dashboard issue listing every pending and errored update
- Shareable presets so many repositories inherit one policy, plus lock file maintenance

The `renovate` service is the bot, on a timer set by `RENOVATE_INTERVAL_SECONDS` and defaulting to the hourly cadence upstream recommends. Redis holds the global lookup cache — the answers to "what versions of this package exist" — shared across every repository and run. The bucket holds each repository's extracted dependencies, so repeat runs skip parsing they already did.

## Why Deploy Renovate on Railway

Railway removes the scheduling and storage plumbing self-hosted Renovate needs.

- Redis and object storage provisioned and wired up, no connection strings to write
- The bot runs on a loop with automatic restarts, so no external cron is required
- A persistent volume keeps Git clones and caches warm between runs
- A status dashboard and health check ship with the deploy

## Common Use Cases

- Keeping a private monorepo's npm, Docker and Actions dependencies current without giving a hosted bot access to the code
- Running dependency automation against a self-managed GitLab, Gitea or Forgejo
- Enforcing one upgrade policy across dozens of repositories through a shared preset
- Getting security patches proposed as pull requests within the hour

## Dependencies for Renovate

- **Renovate worker** — [gridalpha/renovate-railway](https://github.com/gridalpha/renovate-railway), built on the official [`renovate/renovate`](https://hub.docker.com/r/renovate/renovate) image. Runs the bot, serves the dashboard.
- **Redis** (`redis:8.2`) — global lookup cache for versions and changelogs. Private only.
- **Object storage bucket** — S3-backed cache of extracted dependency state.

### Environment Variables Reference

| Variable | Purpose |
|---|---|
| `RENOVATE_TOKEN` | Platform token — the only value you must supply. |
| `RENOVATE_PLATFORM` | `github`, `gitlab`, `bitbucket`, `azure`, `gitea`, `gerrit`. |
| `RENOVATE_ENDPOINT` | API base URL for a self-managed platform. |
| `RENOVATE_REPOSITORIES` | Explicit list instead of autodiscovery. |
| `RENOVATE_INTERVAL_SECONDS` | Gap between runs, default 3600. |
| `RENOVATE_DRY_RUN` | Preview without opening pull requests. |
| `STATUS_PASSWORD` | Password for the status dashboard. |

### Deployment Dependencies

- Source repo: [gridalpha/renovate-railway](https://github.com/gridalpha/renovate-railway)
- Upstream and docs: [renovatebot/renovate](https://github.com/renovatebot/renovate), [docs.renovatebot.com](https://docs.renovatebot.com)

## Hardware Requirements for Self-Hosting Renovate

| Resource | Minimum | Recommended |
|---|---|---|
| CPU | 1 vCPU | 2 vCPU |
| RAM | 2 GB | 4-8 GB |
| Storage | 5 GB volume | 10 GB+ for many large repositories |
| Runtime | Node.js 24 (bundled) | Node.js 24 (bundled) |

Memory is what matters: Renovate clones repositories and runs the real package manager to refresh lock files, so large builds need headroom.

## Self-Hosting Renovate with Docker

Renovate ships as a container that runs once and exits, which is why a scheduler is part of any real deployment. A single run against two repositories:


```
docker run --rm \
  -e RENOVATE_TOKEN=your_token_here \
  -e RENOVATE_PLATFORM=github \
  renovate/renovate:latest \
  your-org/repo-one your-org/repo-two
```

To discover everything the token can see and cache lookups in Redis between runs:

```
docker run --rm \
  -e RENOVATE_TOKEN=your_token_here \
  -e RENOVATE_AUTODISCOVER=true \
  -e RENOVATE_REDIS_URL=redis://redis:6379 \
  -e RENOVATE_REPOSITORY_CACHE=enabled \
  -v renovate-data:/tmp/renovate \
  renovate/renovate:latest
```

Every self-hosted option has an environment variable form: camelCase becomes `RENOVATE_` plus upper snake case, so `repositoryCacheType` is `RENOVATE_REPOSITORY_CACHE_TYPE`.

## How Much Does Renovate Cost to Self-Host?

Renovate is free and open source under AGPL-3.0, with no paid tier and no per-repository charge for the self-hosted bot. Mend.io sells a separate hosted product, but the CLI and image used here are the complete tool. On Railway you pay only for infrastructure — a bot watching a handful of repositories hourly is mostly idle.

## Renovate vs Dependabot

| | Renovate | Dependabot |
|---|---|---|
| Platforms | GitHub, GitLab, Bitbucket, Azure DevOps, Gitea, Gerrit | GitHub |
| Self-hosting | First-class, official image | Limited |
| Package managers | 90+ | Fewer |
| Grouping and scheduling | Fully configurable | Basic |

Dependabot is the lower-effort choice inside GitHub; Renovate wins when repositories live elsewhere or one policy must cover many of them.

## FAQ

**What is Renovate?**
An open-source bot that scans repositories for outdated dependencies and opens pull requests to update them, across ninety-plus package managers and several Git platforms.

**What does this Railway template deploy?**
A Renovate worker running the bot on a schedule behind a password-protected status dashboard, a Redis service for the global lookup cache, an object storage bucket for the per-repository cache, and a persistent volume for Git clones.

**Why does this template include Redis and object storage?**
Renovate re-checks the same packages across every repository and run. Redis holds those version lookups so registries are not queried repeatedly; the bucket holds extracted dependency state so repeat runs skip work already done.

**How do I create the token for self-hosted Renovate on GitHub?**
A classic personal access token with the `repo` scope works; a fine-grained token needs read and write on contents, pull requests and issues. For an organisation, register a GitHub App and pass an installation token, so pull requests come from a bot identity.

**How often does Renovate run, and can I change it?**
Hourly by default. Set `RENOVATE_INTERVAL_SECONDS` to change it, with a 60-second floor, or use Renovate's `schedule` option in `renovate.json` to confine updates to weekday mornings.

**Can I preview what Renovate would do before it opens pull requests?**
Set `RENOVATE_DRY_RUN` to `lookup`. The bot runs the full scan and logs every pull request it would have created, without touching your repositories.


## Similar templates

- [N8N Main + Worker](https://railway.com/deploy/n8n-main-worker) — Deploy and Host N8N with Inactive worker.
- [Evolution API with n8n](https://railway.com/deploy/evolution-api-with-n8n) — Build a WhatsApp automation platform with Evolution API, n8n & Postgres.
- [Postgres Backup](https://railway.com/deploy/postgres-s3-backups) — Cron-based PostgreSQL backup to bucket storage

Open this page in a browser: https://railway.com/deploy/renovate