Allow services to be run in privileged mode

2 years ago

Some services require their container to be run in privileged mode. Currently, this is prohibited in Railway. It would be nice to have a solution to enable it.

5 Replies

2 years ago

One example is gitea's act_runner (basically their version of Github self-hosted runners). They essentially need access to Docker Engine, which I understand requires privileged mode


imedwei
PRO

7 months ago

I examined Gitea's act_runner but can't find a way to run with privileged access on Railway, preventing me from using Docker images.


imedwei
PRO

7 months ago

Railway doesn't officially document this, but these forum posts confirm it doesn't support nested containerization—Docker and Podman can't run within projects. This appears to be a deliberate security measure: Railway enforces strict container isolation by prohibiting privileged containers, blocking Docker daemon access, and preventing container runtime installations.

Since my tests required Docker to spawn a local Postgres instance with pgtestdb, I worked around this by creating a dedicated Railway Postgres instance exclusively for testing.

Also see "You simply can't do such things on Railway."


imedwei

Railway doesn't officially document this, but these forum posts confirm it doesn't support nested containerization—Docker and Podman can't run within projects. This appears to be a deliberate security measure: Railway enforces strict container isolation by prohibiting privileged containers, blocking Docker daemon access, and preventing container runtime installations.Since my tests required Docker to spawn a local Postgres instance with pgtestdb, I worked around this by creating a dedicated Railway Postgres instance exclusively for testing.Also see "You simply can't do such things on Railway."

7 months ago

I should have said "You simply can't do such things on Railway.. Yet."


imedwei
PRO

7 months ago

Indeed, there is hope that someday this will be supported on Railway. fly.io seems to support this with its Firecracker microVM architecture, which provides each "container" with VM-level isolation.

This is not blocking me, nor is it a critical use case for me; however, some use cases genuinely require privileged mode. Up to Railway to decide which market opportunities to pursue. We should start a feedback where people can +1 to inform Railway of the value of this use case.


Loading...