Private networking

Services in one environment reach each other by name over a private network that spans every host.

Names

Every service has a private name, <name>.internal (also <name>.railway.internal), set in Settings > Networking. Call it on the port your service listens on:

http://api.internal:8080

Or use references: ${{api.RAILWAY_PRIVATE_DOMAIN}}.

DNS answers with the healthy replicas (TTL 5 seconds), on whichever hosts they run. Renaming keeps the old name working for 24 hours.

Across hosts

With two or more hosts, traffic between them goes over WireGuard (UDP 51820). Source addresses are kept, so logs show the real caller.

Isolation

• Environments and projects cannot reach each other.
• Containers cannot reach the host, the cloud metadata address 169.254.169.254 or the mesh, unless an Admin turns on Allow metadata for that service.
• Private DNS keeps answering from the agent's cache while the control plane is down.

Next steps

• Quarantined environments
• Replicas and zero-downtime deploys: keep-alive timeouts for internal callers.