The railway ssh command supports running a single command non-interactively via railway ssh -- , and you can authenticate it in CI/CD by setting the RAILWAY_TOKEN environment variable (a project token). That said, for running Liquibase migrations, the recommended approach is to use a pre-deploy command in your service settings, which executes within the private network with access to all your service's environment variables, and runs automatically before each deployment. Note that railway run executes commands locally, so it would not have access to the private network.

thanks, if I use liquibase command as pre-deploy then does it mean liquibase should be installed ahead on the docker image? or railway able to run the liquibase command on db without my image having liquibase ?