Deploy and Host self hosted Supabase Storage (Open-Source File Storage) on Railway

Self-hosted Supabase Storage on Railway puts file buckets next to Postgres and Auth: bytes on the volume at /var/lib/storage, metadata in storage.objects, access gated by RLS policies. Built for app developers who want user uploads without S3 lock-in.

About Hosting Supabase Storage open-source software on Railway (self hosted Supabase Storage template)

You own the bytes and the rows. Railway wires the nine services, generates the JWT secret and dashboard password, and prints your URL plus anon key in the gateway logs. The 50 MB file limit and image transformation being off are already set.

Why Deploy Supabase Storage, the AWS S3 alternative on Railway (Railway Free Trial)

S3 bills per request, per gigabyte stored and per gigabyte moved, and the policy layer is IAM, not SQL. Here access rules are Postgres RLS next to your tables. Start on the $5 trial.

Railway is a singular platform to deploy your infrastructure stack. Railway will host your infrastructure so you don't have to deal with configuration, while allowing you to vertically and horizontally scale it.

By deploying Supabase Storage on Railway, you are one step closer to supporting a complete full-stack application with minimal burden. Host your servers, databases, AI agents, and more on Railway.

Railway vs Other Hosting Providers and VPS for Supabase Storage self hosting

Storage-api needs its Postgres and gateway, so the host carries nine services, not one container.

Provider	What You Get with Railway	What You Get with the Other Provider
DigitalOcean	Template deploy, private networking, volume at /var/lib/storage	Droplets or App Platform; you wire Compose and TLS
AWS	One project, generated JWT and DB secrets, gateway URL in logs	ECS or EC2 plus S3, IAM, and a load balancer
Hetzner	Per-service logs and metrics, redeploy from the dashboard	Cheap VPS; you own backups, updates, and the proxy

Common Use Cases for hosted Supabase Storage

User avatars in per-user folders: Upload to avatars/{user_id}/avatar.png and let an RLS policy on storage.objects check (storage.foldername(name))[1] = auth.uid()::text so users can only write their own folder.
Private invoices behind signed URLs: Keep the bucket private and hand out createSignedUrl(path, 3600) links from a server route instead of exposing the object path.
Public marketing assets: Public buckets serve directly at /storage/v1/object/public/assets/hero.png, so you skip signing logic for images and fonts that are meant to be shared.
Large video uploads with resumable uploads: Use TUS at /storage/v1/upload/resumable with 6 MB chunks for multi-minute clips, since this template caps regular uploads at 50 MB.
Moving media to S3 or R2 later: Metadata and policies stay in Postgres, so switching STORAGE_BACKEND to s3 and copying the objects over keeps your paths and RLS rules intact.

Dependencies for Supabase Storage Docker hosted on Railway

Storage isn't standalone here. The gateway routes /storage/v1 to this service, and Studio reads buckets through the same path.

Deployment Dependencies for Managed Supabase Storage Service (File Storage)

Railway wires these automatically: shared JWT_SECRET so anon and service_role keys match everywhere, POSTGRES_PASSWORD for the db connection, and a volume mounted at /var/lib/storage for the file backend. The gateway prints your URL and anon key in deploy logs.

Implementation Details for Supabase Storage (Using Supabase official docker image)

The service runs the upstream storage-api image with STORAGE_BACKEND=file, FILE_STORAGE_BACKEND_PATH=/var/lib/storage, FILE_SIZE_LIMIT=52428800 (50 MB) and ENABLE_IMAGE_TRANSFORMATION off, since there's no imgproxy. Back up both together.

How does Supabase Storage compare against other file storage services

Supabase Storage vs AWS S3 (S3 Alternative)

Policy model: Access is RLS on storage.objects, the same SQL you write for your tables. S3 needs IAM plus presigned URLs.
Where S3 wins: Lifecycle rules, versioning and replication are far ahead of a single volume file backend.
Metadata: Buckets and objects are Postgres rows, so joins are plain SQL instead of HTTP lookups.

Supabase Storage vs Firebase Storage (Firebase Alternative)

Lock-in: Supabase is Apache-2.0 and runs in your Railway project. Firebase Storage is proprietary and tied to Google Cloud.
Rules: Security rules are a separate language; here it's Postgres RLS with auth.uid(), the session you already have.
Where Firebase wins: Mobile SDKs and offline caching are smoother, and Google runs the backend for you.

Supabase Storage vs Cloudflare R2 (S3 Compatible Alternative)

Backend choice: This template starts on the file backend at /var/lib/storage; set STORAGE_BACKEND=s3 to use R2 or S3.
Where R2 wins: It's object storage with edge delivery built in, so global reads are its core job, not a side feature.
Coupling: You get RLS, signed URLs and Postgres metadata in one service. R2 is one layer and you wire auth yourself.

Supabase Storage vs UploadThing (UploadThing Alternative)

Scope: UploadThing is a hosted upload helper for React apps. This is a full bucket service with its own database.
Where UploadThing wins: Less setup for a quick file input, and it handles the upload UI plumbing.
Control: Files sit on a volume you back up, and access is RLS you can read. No vendor dashboard in between.

How to use Supabase Storage (the OSS Firebase alternative)?

Open Studio on your gateway domain, log in as supabase with DASHBOARD_PASSWORD from Railway variables, and create a bucket called avatars.
Let each user upload into their own folder (add a matching select policy for reads):

create policy own_folder on storage.objects for insert to authenticated
with check (bucket_id = 'avatars' and (storage.foldername(name))[1] = auth.uid()::text);

Upload from the browser with the anon key and the signed-in session:

await supabase.storage.from('avatars').upload(userId + '/avatar.png', file);

Read private files with a signed URL that expires in an hour:

await supabase.storage.from('avatars').createSignedUrl(userId + '/avatar.png', 3600);

Keep the service_role key server-side and never ship it to a browser.

How to self host Supabase Storage on other VPS Services (Supabase self hosting guide)

Clone the Repository

git clone --depth 1 https://github.com/supabase/supabase
cd supabase/docker

Install Dependencies

Install Docker Engine and the Compose plugin. A 4 GB RAM box is the upstream minimum; give the storage volume room for files.

Configure Environment Variables

Copy .env.example to .env and change every secret: JWT_SECRET, POSTGRES_PASSWORD, DASHBOARD_PASSWORD. Turn image transformation off unless you add imgproxy.

Start the Supabase Storage Application

docker compose pull
docker compose up -d

Point your domain at the gateway on port 8000. Files land on the volume; bucket and object metadata stay in Postgres, so snapshot both.

Railway does this for you: it generates the secrets, wires the nine services, mounts the storage volume, and prints the URL and anon key in the deploy logs.

Official Pricing of Supabase Storage (Supabase pricing)

Supabase Storage is Apache-2.0, so self hosting costs nothing in license fees; on Railway you pay only for compute and the storage volume.

On Supabase Cloud, Free covers 2 projects with 500 MB database and pauses after a week idle, Pro is 25 USD/mo per org with 10 USD compute credits, Team is 599 USD/mo, and Enterprise is custom. Storage past the included quota is billed on cloud plans.

Supabase Storage cloud vs self hosted comparison (Pricing, features, costs, and more)

Self hosting Supabase Storage is free in license terms (Apache-2.0), so your bill is the machine, the volume, and your time. Cloud plans bundle managed backups and branching; here you own both.

Monthly cost of self hosting Supabase Storage on Railway

This template runs about 20-40 USD/mo at light use for the nine small services, and that climbs as Postgres and the storage volume grow. Railway's 5 USD trial covers the first look.

System Requirements for Hosting Supabase Storage on a VPS

Upstream suggests at least 4 GB RAM for the full stack: Postgres, Storage, Auth, REST, Realtime, Meta, Edge Functions, Studio and the gateway.

Frequently Asked Questions (FAQs)

What is the max file size, and how do I raise it?

50 MB on this template, set by FILE_SIZE_LIMIT=52428800 on the storage service. Raise that variable, and check any per-bucket limit, which can be lower but never higher.

Why does my upload return 403?

No RLS policy on storage.objects matched the insert for that bucket and path. Add a policy for the bucket and folder, and remember the service_role key bypasses RLS, so keep it off the client.

How do I serve public files?

Make the bucket public and use /storage/v1/object/public/BUCKET/PATH on your gateway domain. Private buckets need an authenticated request or createSignedUrl.

Can I use S3 or R2 instead of the volume?

Yes. Set STORAGE_BACKEND=s3 plus GLOBAL_S3_BUCKET, GLOBAL_S3_ENDPOINT, GLOBAL_S3_PROTOCOL and the AWS credentials on the storage service, then migrate existing objects yourself.

Are resumable uploads supported?

Yes, over TUS at /storage/v1/upload/resumable with tus-js-client; use it for large video files. Plain upload() is fine for small images.

How do I back up files?

Back up the /var/lib/storage volume and Postgres together, since storage.objects holds the metadata that points at those bytes. Restoring one without the other leaves broken rows or orphaned files.