feat(registry/bpmct/templates/railway): add Railway (via GraphQL) template

[bpmct]

Description

Adds a Railway-backed Coder template under registry/bpmct/templates/railway. Each workspace becomes a fully isolated Railway project (own environment, own volume, own service token), running a container built from a pre-built image on GHCR.

What makes this different from what you'd get with the community terraform-community-providers/railway provider:

• Direct GraphQL, not the provider. The provider hits two blocking issues under stress: railway_volume writes to a service before the service is fully attached (and Railway rejects volumeCreate on services that have had deployments), and variableUpsert triggers extra redeploys that intermittently fail with "Cannot redeploy without a snapshot" / "Cannot redeploy yet, please wait for the original deployment to finish building". This template bypasses the provider and calls the Railway public API directly with curl.
• skipDeploys: true on variableUpsert. Undocumented flag that persists the value without enqueuing a redeploy. serviceInstanceDeployV2 is what actually deploys, and picks up the freshly-set variables.
• serviceInstanceUpdate(source: { image }) + serviceInstanceDeployV2 for the image deploy, rather than serviceConnect (which builds from a repo on every start). Median start time drops from ~62s (repo build) to ~6s (pre-built image).
• Explicit volumeCreate before any deployment activity, with backoff on the "creating volumes too quickly" rate limit.

Full write-up, benchmark suite, and three other approaches (Terraform-provider-based, hybrid, Railway-CLI-based) live at bpmct/coder-railway. The variants/wip/image/ directory in that repo is the exact source this template was extracted from.

Demo (Loom, ~5 min)

Note

The Loom was recorded before startup was optimized (per-start Docker build, ~62s median). This template now uses serviceInstanceUpdate(source: { image }) against a pre-built image, so median start time is ~6s. The rest of the flow in the demo (workspace creation, project isolation, Railway CLI) still applies.

Type of Change

• New module
• New template
• Bug fix
• Feature/enhancement
• Documentation
• Other

Template Information

Path: registry/bpmct/templates/railway

Testing & Validation

• Tests pass (bun test)
• Code formatted (bun fmt)
• Changes tested locally

Pushed and running on a Railway-hosted Coder deployment (coder.up.railway.app) as template railway-optimized. Bench numbers against that deployment with the default public image (ghcr.io/bpmct/railway-coder-workspace:latest, no registry credentials):

• Stress: 25/25 concurrent workspace starts (5 iterations of 5 concurrent).
• Create: 5/5 workspace creates from scratch (project + service + volume + first deploy).
• Start (median): ~6s from coder start to agent connected.
• Create (median): ~9s from coder create to first agent connect.

The reliability suite that produced those numbers (parallel start stress test, create stress test, provider-error-scanner) lives at bpmct/coder-railway/scripts/.

Related Issues

None.

File layout

.icons/railway.svg                                    # new (no railway icon existed)
registry/bpmct/templates/railway/
├── README.md                                         # frontmatter + Loom + reasoning + usage + extend guidance
├── main.tf                                           # wires TF resources to scripts/*.sh
├── build/
│   ├── Dockerfile                                    # FROM codercom/enterprise-base:ubuntu + entrypoint
│   └── entrypoint.sh                                 # Railway volume chown + CODER_INIT_SCRIPT_B64 decode + drop to coder
└── scripts/
    ├── lib.sh                                        # shared: gql(), lookup_*(), load_state()
    ├── project_create.sh / project_destroy.sh
    ├── service_create.sh / service_destroy.sh
    ├── volume_create.sh
    ├── env_vars_create.sh / env_vars_destroy.sh      # variableUpsert with skipDeploys: true
    ├── image_deploy_create.sh / image_deploy_destroy.sh  # serviceInstanceUpdate + deployV2
    └── project_token_create.sh / project_token_destroy.sh

Bash bodies live in scripts/*.sh, one file per (resource, action). main.tf only wires command = "bash ${path.module}/scripts/X.sh" and passes runtime values via environment {} blocks. Destroy provisioners reference self.input.* because vars/locals/data are not allowed in destroy scopes.

---

🤖 Generated with Coder Agents using Claude, on behalf of @bpmct

[DevelopmentCats]

@bpmct Everything works well for me as well. I just wanted to test it as well because I haven't had a chance to mess with railway much but I picked out a few things maybe worth changing before we commit but otherwise LGTM!