railway IaC project variables policy controls variable diffs
Introduced 2026-10-08 · score 0.92
HOW TO USE IT
When IaC should not own some or all project variables, set the project-level `variables` policy: `ignore` excludes matching keys from both sides of the diff, and `managed: false` prevents variable sets and deletes. A service declaring `env` or `variables` is an error when `managed` is false.
project("example", { variables: { managed: true, ignore: ["SECRETS_*", "web/*"] }, resources: [...] })railway config planrailway config applyWHY THIS HELPS
Configure IaC variable ownership and ignored keys when planning or applying project configuration.
BEFORE THIS CHANGE
Before this change, a desired service with no `env` could delete every remote variable; `preserve()` only protected variables per key.
REQUIREMENTS AND LIMITATIONS
- Version: v5.64.0
- variables.managed: Boolean ownership setting. `false` prevents variable sets and deletes; services declaring `env` or `variables` then cause an error. Defaults to `true` when the policy is absent.
- variables.ignore: Array of key patterns to exclude from both sides of the diff; ignored keys are never set or deleted. Defaults to `[]`.
- variables.ignore` pattern `KEY_GLOB`: Matches that key on every service. Only `*` is special; matching is case-sensitive and applies to the full key.
- variables.ignore` pattern `service/KEY_GLOB`: Matches keys only on the named resource. Only `*` is special; matching is case-sensitive and applies to the full key.
- Prerequisite: Install the CLI and authenticate; connect the current directory to the target project and environment with `railway link`.
- Prerequisite: Install the matching IaC authoring package: TypeScript `npm install railway`; Python `pip install railway-sdk`; Go `go get github.com/railwayapp/railway-go-sdk@v0.3.0`. Python and Go authoring are beta.
- `KEY_GLOB` matches that key on every service; `service/KEY_GLOB` matches only on the named resource.
- Only `*` is special; matching is case-sensitive and applies to the full key.
- Ignored keys are removed from both sides before diffing and are never set or deleted.
- With `managed: false`, a service declaring `env` or `variables` is an error.
- The policy defaults to `{ managed: true, ignore: [] }` when absent.
FIRST-PARTY EVIDENCE
- https://github.com/railwayapp/cli/releases/tag/v5.64.0
- https://github.com/railwayapp/cli/pull/1256
- https://docs.railway.com/infrastructure-as-code
Check the installed version and the source before using it. Entry JSON