---
title: "Deploy Supabase RLS"
description: "Row level security policies for your self-hosted Supabase"
category: "Storage"
url: https://railway.com/deploy/deploy-supabase-row-level-security
---

# Deploy Supabase RLS

Row level security policies for your self-hosted Supabase

**[Deploy Supabase RLS on Railway](https://railway.com/template/deploy-supabase-row-level-security)**

Machine-readable deploy manifest (JSON, validated by TemplateCI): https://railway.com/deploy/deploy-supabase-row-level-security/manifest.json

- **Creator:** onepush
- **Category:** Storage

## Template content

### studio

- **Image:** ghcr.io/onepush-dev/supabase-studio:2026.10@sha256:38b4da0f64779557c9e45ddaad54fb6fc13c43342b6a3735ebc4caa3f1d38134
- **Health check:** /api/platform/profile

### storage

- **Image:** ghcr.io/onepush-dev/supabase-storage:2026.10@sha256:d9018525e8cd4f28844b9392f22c9be52c3c4639d28c3f1afe123dca2a91c8c5
- **Health check:** /status

### db

- **Image:** ghcr.io/onepush-dev/supabase-db:2026.10@sha256:4936b9cfac0cb3899f7635423af568aa6c2274f9604aa3fcad0a54fd055ca1fc

### rest

- **Image:** postgrest/postgrest:v14.17@sha256:c9dc201e555f5d8e37e7f39cdd4df0229774996e213bfd7de8d10ac609030f2c

### supabase

- **Image:** ghcr.io/onepush-dev/supabase-gateway:2026.10@sha256:d7489fa86d5ea212547271e2fc5d29bcf8d04b8d7ab3c4f5db026feacee7fed9
- **Public domain:** Yes

### realtime

- **Image:** supabase/realtime:v2.134.10@sha256:cbcc6a7986fc28b6dcffa798b077d5fb9c69cd25500371ab49147a86d7edbb03

### auth

- **Image:** supabase/gotrue:v2.196.0@sha256:c0c25187a6b835e65a6f6e6c6b39d090e832d40e6de5186f2c038e0411944232
- **Health check:** /health

### functions

- **Image:** ghcr.io/onepush-dev/supabase-functions:2026.10@sha256:1b6159cc1316fd11f26176cd7a0483e42dffb7642a2e20c1a816b07e357a8063

### meta

- **Image:** supabase/postgres-meta:v0.99.0@sha256:9a079ac1c94d89629262822a4bd1902d5b1be4adb464e5a0a8fd078aaed72158
- **Health check:** /health

## Documentation

# Deploy and Host self hosted Supabase RLS (Row Level Security for Self-Hosted Supabase) on Railway

This template gives you a self-hosted Supabase stack with Row Level Security policies at the center of the design.

## About Hosting Supabase RLS open-source software on Railway (self hosted Row Level Security in self-hosted Supabase template)

This template runs the full self-hosted Supabase stack on Railway, nine services from Postgres 17 and GoTrue auth to Studio, behind one public gateway.

Railway handles builds, the private network, public domains and volumes. You still own the policies.

## Why Deploy Supabase RLS, the Firebase Security Rules alternative on Railway (Railway Free Trial)

Firebase Security Rules work, but they use a proprietary language tied to Google's stack.

Railway is a singular platform to deploy your infrastructure stack. Railway will host your infrastructure so you don't have to deal with configuration, while allowing you to vertically and horizontally scale it.

By deploying Supabase RLS on Railway, you are one step closer to supporting a complete full-stack application with minimal burden. Host your servers, databases, AI agents, and more on Railway.

### Railway vs Other Hosting Providers and VPS for Supabase RLS self hosting

Here is how Railway compares with a plain VPS for this stack.

| Provider | What You Get with Railway | What You Get with the Other Provider |
| --- | --- | --- |
| DigitalOcean | One click deploy of all nine services, generated secrets, and the anon key in the deploy logs. | A droplet you size yourself, but you write the compose file and handle updates. |
| AWS | Managed networking and volumes, so no VPC work before your first policy test. | Fine-grained control over instances and backups, with more knobs and more billing surprises. |
| Hetzner | Setup in minutes, with restarts and redeploys handled for you. | Low raw compute prices per GB of RAM, if you are happy owning the ops work. |

Choose Railway to start writing RLS policies today, or a VPS if you want full host control.

## Common Use Cases for hosted Supabase RLS

- **Per-user rows for a todo or notes app:** Each row stores a user_id referencing auth.users, and one policy lets users touch only rows where that column matches auth.uid(). The anon key in the browser is then safe, because the database filters every query.
- **Team membership access:** A memberships table links users to teams, and policies check for a matching row before returning team data.
- **Public read with owner-only write:** Anyone can select published posts, while insert, update and delete require that auth.uid() owns the row.
- **Private storage buckets per user:** Storage uses RLS on storage.objects, so a policy can check bucket_id and that the first folder name equals auth.uid() as text.
- **Admin roles via JWT claims:** Store the role in app_metadata, which users cannot edit, and check it with auth.jwt() in the policy.

## Dependencies for Supabase RLS Docker hosted on Railway

Supabase RLS on Railway is the whole Supabase stack running as nine services.

### Deployment Dependencies for Managed Supabase RLS Service (Backend as a Service)

The public gateway is the supabase service, running Envoy v1.39.1 on port 8000. Attach the db volume before first boot, or your tables vanish on redeploy.

### Implementation Details for Supabase RLS (Using Supabase official docker image)

The template generates JWT_SECRET, POSTGRES_PASSWORD, DASHBOARD_PASSWORD (username supabase) and PGSODIUM_ROOT_KEY on deploy. The service_role key bypasses RLS, so keep it on the server.

## How does Supabase RLS compare against other ways to secure a Postgres-backed API

Supabase RLS puts access rules in Postgres, so the database refuses rows a caller should not see. Here is how it compares to common alternatives.

### Supabase RLS vs Firebase Security Rules (Firebase Alternative)

- **Rule language:** Firebase uses a custom language on Firestore paths, while RLS uses plain SQL policies.
- **Data model:** Firestore is a document store, whereas RLS works on relational tables and joins.
- **Hosting:** Firebase is a proprietary Google service, and RLS runs on your own Postgres.
- **Where Firebase wins:** its client SDKs are more polished for mobile apps.

### Supabase RLS vs API-layer checks (Server-side Authorization)

- **Enforcement:** API checks live in your server code, so one missed route leaks data, while RLS applies to every query that reaches the table.
- **Flexibility:** code checks can call any service or business rule, which RLS handles less easily.
- **Cost:** RLS needs careful policy writing and testing.
- **Where API checks win:** when the anon key never reaches the browser, a well-tested server layer is simpler.

### Supabase vs Hasura permissions (GraphQL Permissions Alternative)

- **Scope:** Hasura applies role-based row and column rules to GraphQL, while RLS also covers direct SQL and REST.
- **Configuration:** Hasura rules live in its metadata, whereas RLS policies are SQL objects you version with migrations.
- **Column control:** Hasura hides individual columns per role out of the box, which plain Postgres handles with views or grants.
- **Where Hasura wins:** if GraphQL is your main interface, it is the more direct fit.

### Supabase vs PocketBase API rules (Single Binary Alternative)

- **Storage engine:** PocketBase runs on one Go binary with SQLite for small apps, while Supabase runs full Postgres with auth, storage and realtime.
- **Rule format:** PocketBase rules are filter expressions per collection, simpler but less expressive than SQL policies.
- **Scale:** Postgres handles larger datasets, joins and extensions more comfortably.
- **Where PocketBase wins:** for a small app you want running from one file, it is lighter.

## How to use Supabase RLS (the OSS Firebase alternative)?

Lock the table down before any browser code touches it.

1. Open the supabase service domain and log into Studio as supabase with DASHBOARD_PASSWORD.
2. Create a notes table with a user_id uuid column referencing auth.users.
3. Enable Row Level Security, then add select and insert policies checking (select auth.uid()) = user_id.
4. Add an index on user_id.
5. Test with the anon key from the gateway deploy logs, signed out and signed in.
6. Review the security advisor and clear warnings about tables without RLS.

```sql
create table public.notes (
  id bigint generated always as identity primary key,
  body text,
  user_id uuid references auth.users (id) default auth.uid()
);

alter table public.notes enable row level security;

create policy "owners read" on public.notes for select to authenticated
  using ((select auth.uid()) = user_id);

create policy "owners insert" on public.notes for insert to authenticated
  with check ((select auth.uid()) = user_id);

create index notes_user_id_idx on public.notes (user_id);
```

## How to self host Supabase RLS on other VPS Services (Supabase self hosting guide)

This walks through a plain VPS install of the same stack, so you can see where the Row Level Security work lives.

### Clone the Repository

Pull the upstream Supabase Docker setup with a shallow clone.

```
git clone --depth 1 https://github.com/supabase/supabase
cd supabase/docker
```

### Install Dependencies

You need Docker with the Compose plugin and about 4 GB of RAM, the upstream recommendation.

```
docker --version
docker compose version
```

### Configure Environment Variables

Copy the example env file and replace every secret. The anon and service_role keys are derived from JWT_SECRET, so change that first.

```
cp .env.example .env
# edit .env: JWT_SECRET, POSTGRES_PASSWORD, DASHBOARD_PASSWORD, API_EXTERNAL_URL=https://your-domain
```

### Start the Supabase RLS Application

Pull the images and start the stack in the background. Then open Studio, create a table, and enable RLS before you connect any frontend.

```
docker compose pull
docker compose up -d
```

Railway handles the image pulls, secrets, volumes and public domains for you.

## Official Pricing of Supabase RLS (Supabase pricing)

Supabase RLS is free and open source under Apache-2.0, so the policies, helpers, and template carry no license fee.

## Supabase RLS cloud vs self hosted comparison (Pricing, features, costs, and more)

Supabase Cloud bills by plan and project, while this template runs the whole stack on your own infrastructure with no platform fee.

### Monthly cost of self hosting Supabase RLS on Railway

Expect roughly 20 to 40 USD per month for the nine services at light use, with Postgres and storage driving growth as data grows. Railway's 5 USD trial lets you test the stack first.

### System Requirements for Hosting Supabase RLS on a VPS

Upstream recommends at least 4 GB of RAM for nine services with Postgres in the middle. Leave some CPU headroom so policy checks on busy tables don't slow queries.

## Frequently Asked Questions (FAQs)

### What happens if I turn on RLS but add no policies?

Nothing comes back. Add a select policy first and you'll see rows again.

### Why does service_role see every row?

The service_role key bypasses RLS entirely, which is why it has to stay on your server and never ship to a browser.

### Why does my insert fail with a policy error?

Inserts are checked by the with check clause, not the using clause. Make sure the new row's user_id matches auth.uid() and that the request is signed in as authenticated.

### How do I test a policy as a specific user?

In the SQL editor, run set local role authenticated; then set local request.jwt.claims to a JSON object with a sub field set to the user id, and run your query inside a transaction.

### Do policies slow queries down?

They can, especially when auth.uid() is called once per row. Wrap it as (select auth.uid()) so Postgres caches the value per statement, and add an index on any column your policies filter on.

### Do storage buckets use RLS?

Yes.


## Similar templates

- [RustFS | (Just Updated) S3 Object Store, Public URL and Keys Set](https://railway.com/deploy/rustfs-or-just-updated-s3-object-store-p) — S3-compatible object store, keys and public URL preset, volume kept
- [TimescaleDB](https://railway.com/deploy/timescaledb-railway-template) — A PostgreSQL-based time-series database for analytics on Railway.
- [Garage S3 Storage](https://railway.com/deploy/garage-s3-storage) — Ultra-light S3 server: fast, open-source, plug-and-play.

Open this page in a browser: https://railway.com/deploy/deploy-supabase-row-level-security