Running self-hosted Nod on Railway, Render or Fly.io (no Docker host)

[samiabid]

Hey Nod team,

I tried to get Nod running on Railway and hit a wall - the server talks to the workspace and browser with docker exec, and platforms like Railway, Render or Fly.io don't give you a Docker daemon, shared volumes or NET_ADMIN.

Railway Sandboxes (VMs) do work. I got the full stack up with one tweak - the workspace firewall failed because the kernel has no iptables REJECT target, and swapping to DROP fixed it (happy to raise that as a separate issue). Problem is VM pricing, roughly $100/month idle vs $15-25 as normal services.

What I'd like to build, on top of #731:

• NOD_RUNTIME=remote as a third option next to docker and kubernetes
• a small relay in the workspace and browser images, listening on the private network with a shared secret. It only accepts the two command shapes the server already uses (the workspace program via setpriv, and node /app/bridge.mjs), streams stdin/stdout and kills the process group if the connection drops
• a server provider that launches through the relay, the same way the Kubernetes one uses kubectl exec, reusing runSupervisedCommand and the bridge protocol as they are

From what I can see the server doesn't need a shared volume - writeArtifact and readArtifact already go through the command channel, and the local workspace path is only used to build paths and create an empty folder. Please correct me if I've missed something.

It isn't Railway specific either, anything with private networking between services could use it. I'd publish a Railway template alongside.

The trade-off: the workspace firewall can't run on these platforms, so the workspace can reach public addresses and other services on the private network. The relay secret and the database password still protect those, but it is weaker isolation than Compose. The docs would say that plainly and it stays opt-in. Nothing changes in approvals, the trust check, Vault, sign-in or owner isolation.

A few questions before I open a PR:

1. Would you accept a runtime like this?
2. Is it safe to assume the server won't need direct access to workspace files going forward?
3. Should I wait for feat(runtime): add opt-in Kubernetes execution and source builds #731 to land and stack on top of it?

Happy to build it first and post Railway test results here.

Cheers,
Sami

[samiabid]

Quick update - I built it and it's running on Railway as normal services (server, workspace, browser, Postgres), no VM and no Docker host.

What's in it, on top of #731:

• src/providers/remote/relay.mjs - a small dependency-free relay added to the workspace and browser images. It checks a shared token, picks the user and program itself (workspace program via setpriv with no-new-privs and no capabilities, or the browser bridge), and kills the whole process group if the connection drops. It also creates the conversation folder on first use, since there's no shared volume doing that anymore
• src/providers/remote/index.ts - NOD_RUNTIME=remote, plugging into runSupervisedCommand and createBridgeComputer the same way the Kubernetes provider does
• 3 tests in tests/sandbox.test.ts (relay round trip with auth and cancellation, dropped connection kills the process group, privilege rules) plus a docs section in self-host.mdx. The dropped-connection test caught a real bug on the first run, so it earns its place

What I've checked on Railway:

• workspace commands run as uid=1000(node) in /workspace/<thread>
• writeArtifact / readArtifact round trip between services works fine without a shared volume
• browser opens a page, returns the snapshot and a screenshot
• real chat turns from the desktop app (0.7.3, connected to the server): reading my last 2 emails ran its workspace commands through the relay, and "check today's matches on espncricinfo.com" drove Chromium in the browser service and sent back a screenshot. No errors on either

And the honest bit - from the workspace, cloud metadata is blocked by Railway, but Postgres and the server are reachable on the private network. That's the firewall trade-off I mentioned above, and the docs call it out.

Not done yet: lint, typecheck and the docs build (my laptop ran out of disk for the full install 😅). Happy to push the branch somewhere you can look at before I open a PR - just let me know if you'd prefer to wait for #731 first.