---
title: "Deploy YugabyteDB | (Just Updated) Distributed SQL Database, Postgres-Compatible, Password + TLS On, Data Survives Redeploys"
description: "YugabyteDB Postgres-compatible distributed SQL, password and TLS on"
category: "Storage"
url: https://railway.com/deploy/yugabytedb-or-just-updated-distributed-s
---

# Deploy YugabyteDB | (Just Updated) Distributed SQL Database, Postgres-Compatible, Password + TLS On, Data Survives Redeploys

YugabyteDB Postgres-compatible distributed SQL, password and TLS on

**[Deploy YugabyteDB | (Just Updated) Distributed SQL Database, Postgres-Compatible, Password + TLS On, Data Survives Redeploys on Railway](https://railway.com/template/yugabytedb-or-just-updated-distributed-s)**

Machine-readable deploy manifest (JSON, validated by TemplateCI): https://railway.com/deploy/yugabytedb-or-just-updated-distributed-s/manifest.json

- **Creator:** SuperSlowSloth
- **Category:** Storage

## Template content

### yugabytedb

- **Image:** yugabytedb/yugabyte:2026.1.2.0-b137@sha256:b6dba322c7340e1a87affd9b4715fa938354b6ab81b0b0833b07f6b5d085e274
- **Start command:** `/bin/sh -c 'echo IyEvYmluL2Jhc2gKIyBZdWdhYnl0ZURCIHNpbmdsZSBub2RlIGZvciBSYWlsd2F5LiBSdW5zIGFzIHJvb3QgKFJBSUxXQVlfUlVOX1VJRD0wKSwgY2hvd25zIHRoZSB2b2x1bWUsCiMgZHJvcHMgdG8gdGhlIGltYWdlIHVzZXIsIGVuZm9yY2VzIFlTUUwgcGFzc3dvcmQgYXV0aCBhbmQgc2V0cyB0aGUgcGFzc3dvcmQgZnJvbSBZQl9QQVNTV09SRC4Kc2V0IC11Ck09L2RhdGEKQj0kTS95YgpZQl9VSUQ9MTAwMDEKWUJfR0lEPTEwMApJUD0xMjcuMC4wLjEKUEdIPTo6MQpQR1A9NTQzNAoKZWNobyAieXVnYWJ5dGVkYiBib290IHVpZD0kKGlkIC11KSBtb3VudF9vd25lcj0kKHN0YXQgLWMgJXU6JWcgJE0pIgpta2RpciAtcCAiJEIiCmNob3duIC1SICRZQl9VSUQ6JFlCX0dJRCAiJEIiCgojIHNpemUgbWVtb3J5IGZyb20gdGhlIGNvbnRhaW5lciwgbm90IHRoZSBob3N0Ck1FTT0kKGNhdCAvc3lzL2ZzL2Nncm91cC9tZW1vcnkubWF4IDI+L2Rldi9udWxsIHx8IGVjaG8gbWF4KQpUU19NRU09IiIKTVNfTUVNPSIiCmNhc2UgIiRNRU0iIGluCiAgJyd8bWF4KSA7OwogICopIFRTX01FTT0ibWVtb3J5X2xpbWl0X2hhcmRfYnl0ZXM9JCgoTUVNICogNjAgLyAxMDApKSI7IE1TX01FTT0ibWVtb3J5X2xpbWl0X2hhcmRfYnl0ZXM9JCgoTUVNICogMTUgLyAxMDApKSIgOzsKZXNhYwplY2hvICJ5dWdhYnl0ZWRiIGNncm91cCBtZW1vcnkubWF4PSRNRU0gdHNlcnZlcj1bJFRTX01FTV0gbWFzdGVyPVskTVNfTUVNXSIKCgojIFRMUyBmb3IgWVNRTDogc2VsZi1zaWduZWQgY2VydGlmaWNhdGUga2VwdCBvbiB0aGUgdm9sdW1lIHNvIGNsaWVudHMga2VlcCBvbmUgZmluZ2VycHJpbnQgYWNyb3NzIHJlZGVwbG95cwpUPSRCL3Rscwpta2RpciAtcCAiJFQiCmlmIFsgISAtZiAiJFQvc2VydmVyLmNydCIgXTsgdGhlbgogIG9wZW5zc2wgcmVxIC14NTA5IC1ub2RlcyAtbmV3a2V5IHJzYToyMDQ4IC1kYXlzIDM2NTAgLXN1YmogIi9DTj15dWdhYnl0ZWRiIiAta2V5b3V0ICIkVC9zZXJ2ZXIua2V5IiAtb3V0ICIkVC9zZXJ2ZXIuY3J0IiAyPi9kZXYvbnVsbCBcCiAgICAmJiBlY2hvICJ5dWdhYnl0ZWRiIGdlbmVyYXRlZCBzZWxmLXNpZ25lZCBUTFMgY2VydGlmaWNhdGUiIHx8IGVjaG8gInl1Z2FieXRlZGIgVExTIGNlcnRpZmljYXRlIGdlbmVyYXRpb24gRkFJTEVEIgpmaQpjaG1vZCA2MDAgIiRUL3NlcnZlci5rZXkiCmNob3duIC1SICRZQl9VSUQ6JFlCX0dJRCAiJFQiCgpUU19GTEFHUz0ieXNxbF9lbmFibGVfYXV0aD10cnVlLHBnc3FsX3Byb3h5X2JpbmRfYWRkcmVzcz1bOjoxXTo1NDM0LHlzcWxfcGdfY29uZl9jc3Y9e3NzbD1vbixzc2xfY2VydF9maWxlPSckVC9zZXJ2ZXIuY3J0Jyxzc2xfa2V5X2ZpbGU9JyRUL3NlcnZlci5rZXknfSIKWyAtbiAiJFRTX01FTSIgXSAmJiBUU19GTEFHUz0iJFRTX0ZMQUdTLCRUU19NRU0iCmNhdCA+ICRCL3liLmNvbmYgPDxDT05GCnsidHNlcnZlcl9mbGFncyI6IiRUU19GTEFHUyIsIm1hc3Rlcl9mbGFncyI6IiRNU19NRU0ifQpDT05GCmNob3duICRZQl9VSUQ6JFlCX0dJRCAkQi95Yi5jb25mCgojIFlTUUwgbGlzdGVucyBvbiBsb29wYmFjayBJUHY2IG9ubHkgKHl1Z2FieXRlZCByZWplY3RzIGEgZHVhbC1zdGFjayBiaW5kIGFkZHJlc3MpLiBSYWlsd2F5J3MgcHJpdmF0ZSBuZXR3b3JrIGlzIElQdjYKIyBhbmQgaXRzIFRDUCBwcm94eSBtYXkgYXJyaXZlIG92ZXIgSVB2NCwgc28gYSBzbWFsbCBkdWFsLXN0YWNrIGZvcndhcmRlciBvd25zIHRoZSBwdWJsaWMgcG9ydCA1NDMzLiBJdCBzdGFydHMgb25seSBhZnRlcgojIHRoZSBwYXNzd29yZCBpcyBzZXQ6IHl1Z2FieXRlZCdzIHBvcnQgcHJlLWNoZWNrIChydW4gb3V0c2lkZSBkb2NrZXIsIGFzIG9uIFJhaWx3YXkpIHJlZnVzZXMgdG8gc3RhcnQgd2hpbGUgNTQzMyBpcyB0YWtlbiwKIyBhbmQgdGhlIHB1YmxpYyBwb3J0IHN0YXlzIGNsb3NlZCBkdXJpbmcgdGhlIGZpcnN0LWJvb3Qgd2luZG93IHdoZW4gdGhlIHN0b2NrIGRlZmF1bHQgcGFzc3dvcmQgc3RpbGwgd29ya3MuCmNhdCA+ICRCL2Z3ZC5weSA8PCdQWScKaW1wb3J0IGFzeW5jaW8sIHNvY2tldAoKYXN5bmMgZGVmIHBpcGUociwgdyk6CiAgICB0cnk6CiAgICAgICAgd2hpbGUgVHJ1ZToKICAgICAgICAgICAgZCA9IGF3YWl0IHIucmVhZCg2NTUzNikKICAgICAgICAgICAgaWYgbm90IGQ6CiAgICAgICAgICAgICAgICBicmVhawogICAgICAgICAgICB3LndyaXRlKGQpCiAgICAgICAgICAgIGF3YWl0IHcuZHJhaW4oKQogICAgZXhjZXB0IEV4Y2VwdGlvbjoKICAgICAgICBwYXNzCiAgICBmaW5hbGx5OgogICAgICAgIHRyeToKICAgICAgICAgICAgdy5jbG9zZSgpCiAgICAgICAgZXhjZXB0IEV4Y2VwdGlvbjoKICAgICAgICAgICAgcGFzcwoKYXN5bmMgZGVmIGhhbmRsZShjciwgY3cpOgogICAgdHJ5OgogICAgICAgIHVyLCB1dyA9IGF3YWl0IGFzeW5jaW8ub3Blbl9jb25uZWN0aW9uKCI6OjEiLCA1NDM0KQogICAgZXhjZXB0IEV4Y2VwdGlvbjoKICAgICAgICBjdy5jbG9zZSgpCiAgICAgICAgcmV0dXJuCiAgICBhd2FpdCBhc3luY2lvLmdhdGhlcihwaXBlKGNyLCB1dyksIHBpcGUodXIsIGN3KSkKCmFzeW5jIGRlZiBtYWluKCk6CiAgICBzID0gc29ja2V0LnNvY2tldChzb2NrZXQuQUZfSU5FVDYsIHNvY2tldC5TT0NLX1NUUkVBTSkKICAgIHMuc2V0c29ja29wdChzb2NrZXQuU09MX1NPQ0tFVCwgc29ja2V0LlNPX1JFVVNFQUREUiwgMSkKICAgIHMuc2V0c29ja29wdChzb2NrZXQuSVBQUk9UT19JUFY2LCBzb2NrZXQuSVBWNl9WNk9OTFksIDApCiAgICBzLmJpbmQoKCI6OiIsIDU0MzMpKQogICAgcy5saXN0ZW4oNTEyKQogICAgc3J2ID0gYXdhaXQgYXN5bmNpby5zdGFydF9zZXJ2ZXIoaGFuZGxlLCBzb2NrPXMpCiAgICBhc3luYyB3aXRoIHNydjoKICAgICAgICBhd2FpdCBzcnYuc2VydmVfZm9yZXZlcigpCgphc3luY2lvLnJ1bihtYWluKCkpClBZCmNob3duICRZQl9VSUQ6JFlCX0dJRCAkQi9md2QucHkKCiMgc2V0IHRoZSBwYXNzd29yZCBvbmNlIFlTUUwgYW5zd2VyczogdHJ5IHRoZSBnZW5lcmF0ZWQgb25lIGZpcnN0LCBmYWxsIGJhY2sgdG8gdGhlIHN0b2NrIGRlZmF1bHQKKAogIHVudGlsIFBHUEFTU1dPUkQ9IiRZQl9QQVNTV09SRCIgeXNxbHNoIC1oICRQR0ggLXAgJFBHUCAtVSB5dWdhYnl0ZSAtYyAnc2VsZWN0IDEnID4vZGV2L251bGwgMj4mMSBcCiAgICAgfHwgUEdQQVNTV09SRD15dWdhYnl0ZSB5c3Fsc2ggLWggJFBHSCAtcCAkUEdQIC1VIHl1Z2FieXRlIC1jICdzZWxlY3QgMScgPi9kZXYvbnVsbCAyPiYxOyBkbyBzbGVlcCAyOyBkb25lCiAgaWYgUEdQQVNTV09SRD0iJFlCX1BBU1NXT1JEIiB5c3Fsc2ggLWggJFBHSCAtcCAkUEdQIC1VIHl1Z2FieXRlIC1jICdzZWxlY3QgMScgPi9kZXYvbnVsbCAyPiYxOyB0aGVuCiAgICBlY2hvICJ5dWdhYnl0ZWRiIHBhc3N3b3JkIGFscmVhZHkgc2V0IgogIGVsaWYgUEdQQVNTV09SRD15dWdhYnl0ZSB5c3Fsc2ggLWggJFBHSCAtcCAkUEdQIC1VIHl1Z2FieXRlIC12IE9OX0VSUk9SX1NUT1A9MSAtdiBwdz0iJFlCX1BBU1NXT1JEIiA+L2Rldi9udWxsIDI+JjEgPDwnU1FMJwpBTFRFUiBST0xFIHl1Z2FieXRlIFBBU1NXT1JEIDoncHcnOwpTUUwKICB0aGVuCiAgICBlY2hvICJ5dWdhYnl0ZWRiIHBhc3N3b3JkIHNldCIKICBlbHNlCiAgICBlY2hvICJ5dWdhYnl0ZWRiIHBhc3N3b3JkIHNldCBGQUlMRUQsIHB1YmxpYyBwb3J0IHN0YXlzIGNsb3NlZCIKICAgIGV4aXQgMQogIGZpCiAgZWNobyAieXVnYWJ5dGVkYiBmb3J3YXJkZXIgdXAgb24gWzo6XTo1NDMzIChkdWFsLXN0YWNrKSB0byBZU1FMIFs6OjFdOjU0MzQiCiAgd2hpbGUgdHJ1ZTsgZG8KICAgIHNldHByaXYgLS1yZXVpZD0kWUJfVUlEIC0tcmVnaWQ9JFlCX0dJRCAtLWNsZWFyLWdyb3VwcyBweXRob24zICRCL2Z3ZC5weQogICAgc2xlZXAgMQogIGRvbmUKKSAmCgpleGVjIHNldHByaXYgLS1yZXVpZD0kWUJfVUlEIC0tcmVnaWQ9JFlCX0dJRCAtLWNsZWFyLWdyb3VwcyBcCiAgeXVnYWJ5dGVkIHN0YXJ0IC0tYmFja2dyb3VuZD1mYWxzZSAtLWJhc2VfZGlyPSIkQiIgLS1hZHZlcnRpc2VfYWRkcmVzcz0kSVAgLS1pbnNlY3VyZSAtLXVpPWZhbHNlIC0tY29uZmlnPSIkQi95Yi5jb25mIiBcCiAgPiA+KHRyICdccicgJ1xuJyB8IGdyZXAgLXYgLUUgJ15ccypbLVxcL3xdICcgfCBncmVwIC12ICdeXHMqJCcpIDI+JjEK | base64 -d > /tmp/boot.sh; exec /bin/bash /tmp/boot.sh'`

## Documentation

# Deploy and Host YugabyteDB on Railway

**Built for an LLM agent to deploy and use.** There is no setup wizard and nothing to fill in: a 40-character password is generated at deploy time, TLS is switched on, and a ready-made connection string is published as a variable. A stock YugabyteDB container starts with the well-known default password `yugabyte` (or none at all under `--insecure`); this template replaces it before the public port opens. The contract below lists every address, variable name and the one script that proves it works.

YugabyteDB is an open-source distributed SQL database that speaks the PostgreSQL wire protocol (YSQL), so existing drivers, ORMs and `psql` work unchanged. It is used as a PostgreSQL-compatible database that can later scale out to many nodes. This template runs a single node: one master and one tablet server in one container.

## About Hosting YugabyteDB

This template runs one service, `yugabytedb`, built from the official **YugabyteDB 2026.1.2.0** image (`yugabytedb/yugabyte`, pinned by digest, PostgreSQL 15 compatible). A start command embeds a boot script that runs `yugabyted` as the image user with YSQL authentication enforced. It sizes the tablet server and master memory limits from the container limit instead of the host, creates a self-signed TLS certificate on the volume (so clients see one fingerprint across redeploys), and sets the `yugabyte` role password from `YB_PASSWORD`. YSQL listens on loopback only; a small dual-stack forwarder opens port 5433 on both IPv4 and IPv6 after the password is set, so the public TCP proxy and the private network both reach it and nothing can connect with the stock password. YCQL (Cassandra API), the master and tablet server web UIs and the RPC ports stay on loopback. The YSQL metrics endpoint (13000) is reachable on the private network only. All data lives on the volume at `/data` and survives redeploys. Plan for at least 2 GB of memory; the first boot takes about 40 seconds before connections are accepted, and connections are refused until then.

### Agent contract

- Public address: the TCP proxy of the `yugabytedb` service (`RAILWAY_TCP_PROXY_DOMAIN` and `RAILWAY_TCP_PROXY_PORT`, already inside `YB_DSN`), forwarding to port 5433. Wire protocol, not HTTP.
- Private address: `yugabytedb.railway.internal:5433` (IPv6 private network), published as `YB_PRIVATE_DSN`.
- Credentials: user `yugabyte`, database `yugabyte`, password in `YB_PASSWORD`. Ready connection strings: `YB_DSN` (public) and `YB_PRIVATE_DSN` (private), both with `sslmode=require`.
- Auth: PostgreSQL password authentication (scram or md5, negotiated by the server) over TLS 1.2 or 1.3. The certificate is self-signed, so use `sslmode=require` (encrypts without verifying the chain), not `verify-full`. The stock password `yugabyte` is rejected.
- Health: no HTTP healthcheck (a TCP proxy and an HTTP healthcheck cannot share a service). Readiness is a successful `select 1` through `YB_DSN`.

```bash
# run with YB_DSN and YB_PASSWORD set; needs psql
until psql "$YB_DSN" -tAc 'select 1' | grep -q 1; do sleep 3; done
echo ready
psql "$YB_DSN" -tAc "select 'tls ' || ssl from pg_stat_ssl where pid = pg_backend_pid()"
psql "${YB_DSN/:$YB_PASSWORD@/:yugabyte@}" -tAc 'select 1' |& grep -o 'password authentication failed' | head -1
psql "$YB_DSN" -v ON_ERROR_STOP=1 -tAc 'create table if not exists agent_check (id int primary key, note text)' -c "insert into agent_check values (1, 'hello') on conflict (id) do update set note = excluded.note" -tAc 'select note from agent_check where id = 1'
```

A fresh deploy prints `ready`, `tls t`, `password authentication failed` for the stock-password attempt, then `INSERT 0 1` and `hello`. Applications inside the same Railway project connect with `YB_PRIVATE_DSN` and avoid the public proxy.

## Why Deploy YugabyteDB on Railway?

Railway is a singular platform to deploy your infrastructure stack. Railway will host your infrastructure so you don't have to deal with configuration, while allowing you to vertically and horizontally scale it.

By deploying YugabyteDB on Railway, you are one step closer to supporting a complete full-stack application with minimal burden. Host your servers, databases, AI agents, and more on Railway.

- **Agent-ready** - generated password, ready connection strings, contract block and one working script; no setup step.
- **Closed by default** - the stock `yugabyte` password is replaced before the public port opens, and TLS is on.
- **PostgreSQL compatible** - drivers, ORMs and `psql` work unchanged, with a path to horizontal scale.
- **Right-sized** - memory limits come from the container limit, not from the host.
- **State survives redeploys** - data and the TLS certificate live on a volume.
- **Pinned image** - the YugabyteDB version is pinned, so a redeploy never changes the server underneath you.

## Common Use Cases

- **PostgreSQL-compatible application database** - the same drivers and SQL, on a database designed to scale out.
- **Development and staging for distributed SQL** - test an application against YugabyteDB before a multi-node rollout.
- **Backing store for AI agents** - relational state with transactions, reachable over a private address.

## Dependencies for YugabyteDB Hosting

- None. YugabyteDB stores its own data on the volume at `/data`.

### Deployment Dependencies

- [yugabyte/yugabyte-db](https://github.com/yugabyte/yugabyte-db) - upstream project


## Similar templates

- [RustFS | (Just Updated) S3 Object Store, Public URL and Keys Set](https://railway.com/deploy/rustfs-or-just-updated-s3-object-store-p) — S3-compatible object store, keys and public URL preset, volume kept
- [TimescaleDB](https://railway.com/deploy/timescaledb-railway-template) — A PostgreSQL-based time-series database for analytics on Railway.
- [Garage S3 Storage](https://railway.com/deploy/garage-s3-storage) — Ultra-light S3 server: fast, open-source, plug-and-play.

Open this page in a browser: https://railway.com/deploy/yugabytedb-or-just-updated-distributed-s