8 hours ago
Hi Railway team, we're on Pro and need to confirm two things before relying on them:
-
Private GHCR image pinned by digest: can a service use
ghcr.io/<org>/<pkg>@sha256:<digest>(no tag) with registry credentials, and is that exact digest always the one pulled on redeploy, restart and rollback, never re-resolved or auto-updated? -
Root-owned file on a volume: our app runs as non-root (UID 10001) and must only read a small file on its mounted volume. Is there a supported way to write or replace that file as root (owner 0:0, atomic replace), without changing the service's user or start command? For example
railway sshas root, the volume file upload, or a short-lived root container on the same volume. If none exists, please say so.
Thanks!
1 Replies
Status changed to Awaiting Railway Response Railway • about 8 hours ago
7 hours ago
On the private GHCR image, the registry credentials saved on a service are used when it deploys, but automatic image update checks do not use them, so auto-updates cannot discover new versions of a private image. We have not yet verified whether a digest-only reference is always pulled unchanged on redeploy, restart and rollback, so we cannot confirm that guarantee at this point.
On the volume, volumes are mounted as root, and the documented setting for images that run as a non-root user is RAILWAY_RUN_UID=0. That changes the user the service runs as, so it does not meet your constraint. The CLI can upload, rename and edit files on a volume with railway volume files upload and railway volume files rename (see railway volume). We have not verified which owner those files get or whether a replace is atomic, so we cannot confirm that as a supported way to produce a 0:0 file.
Status changed to Awaiting User Response Railway • about 7 hours ago