Railway to Azure in an hour.
Under your own tenant.
One command. An agent reads your repository and your railway.json, then deploys into the Azure subscription you already own - governed by the directory you already run.
“We migrated our whole staging environment with a single prompt. Production was a one-click clone of staging. Once the tests gave us confidence we moved DNS off Heroku - we have been running production on our own cloud with Qovery ever since.”
“We liked the Heroku experience, and we knew the cloud meant skills and effort we did not have spare - that is why we kept putting the migration off. We do not regret doing it with Qovery. Deployments that took me over two hours now take 30 minutes.”
Railway is the best DX in the category. It is also a ceiling.
The canvas, the templates and the deploy speed are genuinely good, and none of that is what teams leave over. They leave because the workload has outgrown what somebody else’s account can be asked to do.
Four regions, all on Railway’s own metal
- California, Virginia, Amsterdam and Singapore. There is no fifth, and no option to run somewhere your customers or your regulator require. Volumes make this sharper: a volume follows the region of the service it is attached to, so moving a stateful service between regions migrates the volume and takes the service down while it copies. Any Azure region, with multi-region and multi-cluster from one control plane. Storage is not welded to that choice.
Private networking inside a project is not a network you own
- Railway gives services encrypted Wireguard tunnels and internal DNS within a project environment, which is the right design for what Railway is. What it is not is a VPC. There is no security group you write, no peering to the database or the VPN or the internal service you already run elsewhere, and no route table. You already own the virtual network. NSGs, private endpoints, peering and NAT gateway egress are yours, and Entra ID governs who can change any of it.
The plan tier caps the workload itself
- Replica count per service, RAM, vCPU and volume size are all bounded by which plan you are on, so scaling becomes a billing conversation before it is an engineering one. Deploying from a private container registry needs Pro. Egress is metered and billed per gigabyte on top of compute, which penalises exactly the data-heavy services that are hardest to move. Compliance commitments and SLAs live at Enterprise. In your own subscription none of those are tiers: Entra ID governs access, the Azure activity log records the changes, and the capacity ceiling is whatever quota you ask Azure to raise.
Three steps, then the agent does it.
Your side takes about five minutes. Everything after that is automated.
- 01
A service principal provisions the network and an AKS cluster in your own subscription - about twenty minutes, and nothing leaves your boundary. Qovery gets a role you can read, scope down or revoke. Talk to a migration engineer before you connect anything.
- 02
One command teaches your coding agent how to read the repository - a railway.json, a Dockerfile, a Railpack build, a set of variables - and describe the deployment in Qovery’s own terms. Nothing is deployed at this point. You are only giving the agent the vocabulary.
- 03
The agent detects every service, writes a Dockerfile where one is missing, maps your Railway variables to Qovery variables and secrets, and shows you the plan. You approve it before a single resource is created - and your Railway Postgres stays where it is, connected over the network, so you validate against real data before migrating a byte.
- 04Optional
Take this first or last - some teams want it as step zero, before they connect anything. A Qovery staff solution engineer reviews the cluster setup and environment layout with your team, then goes through the practices that keep the estate cheap and quiet: node sizing and Spot policy, autoscaling thresholds, preview-environment lifetimes, secret scoping and how to promote the same artifact between stages.
- network
- your VPC, three fixed egress IPs
- cluster
- AKS, in your region
- access
- a role scoped to Qovery
Works with any coding agent that reads skills. Nothing is deployed at this point.
web Node.js 20 Dockerfile generated worker Node.js 20 detected from railway.json scheduler cron 2 jobs database PostgreSQL 15 Railway Postgres, connected remotely
Nothing has been created yet. You approve the plan first.
- cluster
- node sizing, Spot policy, autoscaling
- workflow
- stages, approval gates, preview TTLs
- access
- secret scoping, roles per environment
From there it is automatic. Your apps come up running and live on Azure, reachable on a public URL - while the Railway stack keeps serving traffic untouched.
You pay Azure. And it counts toward your commitment.
Money metered by Railway counts toward nothing. If your organisation has an Enterprise Agreement or a MACC, the same compute running in your own subscription draws down an obligation you owe Microsoft regardless - which for most finance teams turns the migration from a cost into a transfer.
Depends on your replica counts, RAM and vCPU footprint, volume storage, egress volume and region. A migration engineer will model your estate against the equivalent Azure shape before you commit to anything.
Why Azure, when the blocker is the network or the auditor.
The usual reason a team outgrows Railway is not price. It is that something now has to be reached privately, or evidenced to somebody, and a project-scoped Wireguard network cannot do either.
A virtual network, not a project-scoped tunnel
- Railway gives services encrypted tunnels and internal DNS inside a project environment. It does not give you a network. In your own subscription you get a virtual network with NSGs you write, private endpoints onto Azure Database and Key Vault, peering to the estate you already run, and a NAT gateway with stable egress addresses somebody else can allowlist.
Entra ID governs deployment, and the audit trail is yours
- Access is decided by the directory you already run - your groups, your conditional access policies, your leaver process - rather than by a separate list of project members. Qovery supports SAML SSO, and the Azure activity log records every change to the infrastructure in a tenant your auditors can already reach.
Spend counts toward your EA or MACC
- Compute runs on AKS in your subscription, so it draws down an Enterprise Agreement or Microsoft Azure Consumption Commitment like any other Azure workload. Reserved instances cover the steady-state footprint and the savings plan for compute covers the part that moves. On a metered platform there is nothing to reserve and nothing to draw down.
Our control plane. Your account, your bill.
Qovery sits above the infrastructure and never owns it. Every cluster, database and bucket is provisioned inside the Azure subscription you already hold - Azure invoices you directly.
- We do not take a cut of your Azure spend. A flat subscription, whether your bill is $2k or $200k.
- We push it the other way: idle nodes, oversized requests and preview environments left running get flagged so you stop paying for them.
- Railway runs all of this on its own metal. Qovery runs it in yours.
Not sure which Azure services fit your workload? A solution engineer will map it with you.
CONTROL PLANEStop paying Qovery and the stack keeps running - the manifests and qovery/qovery Terraform are already in your account.
Your first service on Azure,
live within the hour.
Any Azure region, with multi-region and multi-cluster from one control plane. Nothing you do here touches your existing Railway project until you decide to move the domain.
Railway to Azure
Something not covered here? Talk to a migration engineer - they have done this on estates larger than yours.