Deploy Dify LLM Platform on PAI-EAS for Scalable AI Inference - Platform for AI - Alibaba Cloud - Platform For AI

Deploying Dify on PAI-EAS provides a managed service with elastic scaling, which eliminates infrastructure maintenance and accelerates the development from prototype to production.

How it works

PAI-EAS builds a complete service by running Dify components in a multi-container environment and mounting external dependencies, including ApsaraDB RDS for PostgreSQL, ApsaraDB for Redis, Alibaba Cloud Elasticsearch, and Object Storage Service (OSS). All components communicate over a Virtual Private Cloud (VPC) network.

The core components of the architecture include:

PAI-EAS service: As the core computing platform, PAI-EAS runs all Dify service components in a multi-container environment, including the web interface, API backend, asynchronous task workers, and a plugin sandbox. PAI-EAS manages the service lifecycle, resource scheduling, and network configuration.
ApsaraDB RDS for PostgreSQL: Stores data for users, conversations, knowledge bases, workflows, and plugin configurations. Separating the database from the application ensures data persistence and independence.
ApsaraDB for Redis: Provides high-performance caching and message queue functionality. It is used to cache frequently accessed data, manage session states, and distribute asynchronous tasks among Dify components through the Celery Broker.
Alibaba Cloud Elasticsearch: Serves as a vector database and full-text search engine. In retrieval-augmented generation (RAG) scenarios, it stores, indexes, and efficiently retrieves documents from the knowledge base.
Object Storage Service (OSS): Stores persistent data, such as plugin and knowledge base files, ensuring data survives service updates and restarts.

Users access the Dify interface through the web service URL provided by PAI-EAS. All requests are first routed by the Nginx container to either the Dify-Web or Dify-API container. When processing business logic, the API service interacts with the backend ApsaraDB RDS for PostgreSQL, ApsaraDB for Redis, and Alibaba Cloud Elasticsearch. Asynchronous tasks, such as document indexing, are delivered to the worker container for execution via Redis. All files that require persistence are read from and written to the mounted OSS path.

Step 1: Prepare dependent resources

Before deploying Dify, prepare the required external services. To avoid network connectivity issues, ensure that all these resources are in the same region and Virtual Private Cloud (VPC) as the PAI-EAS service you plan to deploy.

Important

The VPC for an ApsaraDB RDS for PostgreSQL or Alibaba Cloud Elasticsearch instance cannot be changed after creation. Therefore, you must create these instances in the same VPC as your PAI-EAS service.

Plan a Virtual Private Cloud (VPC). If you do not have one, create a VPC and a vSwitch.
Create an ApsaraDB RDS for PostgreSQL instance. After the instance is created, create a high-privilege account. Use this account to create two databases: one for Dify's core function data and another for its plugin data. For more information, see Create accounts and databases.
Important
We recommend PostgreSQL 16. Version 18 may cause a uuidv7 function conflict.
Create an ApsaraDB for Redis instance. To allow PAI-EAS containers to access the instance, add the IP address range of the PAI-EAS vSwitch to the Redis allowlist. You can obtain this information from the vSwitch details page in the VPC console.
Create an Alibaba Cloud Elasticsearch instance. This instance serves as the vector database and full-text search engine for the knowledge base. Ensure that it is in the same VPC as the PAI-EAS service.

Step 2: Deploy the Dify service

Log on to the PAI console. Select a region on the top of the page. Then, select the desired workspace and click Elastic Algorithm Service (EAS).
On the Inference Service tab, click Deploy Service. In the Scenario-based Model Deployment section, click Dify LLM platform.
On the deployment page, configure the following parameters.
- OSS: Select an OSS bucket and specify a path for persistent storage of knowledge base files, plugin data, and other data. Two folders, dify and dify_plugin, are automatically created in the specified path.
- PostgreSQL configuration:
  - Host Address: Enter the internal IP address of the ApsaraDB RDS for PostgreSQL instance. You can find this on the Database Connection page for the instance in the ApsaraDB RDS for PostgreSQL console.
  - Port: The default is 5432. Enter the actual port if it is different.
  - Database - core data: Enter the name of the database created to persistently store data related to core functions, such as applications, users, conversations, knowledge bases, workflows, and model configurations.
  - Database plugins: Enter the name of the database created to persistently store information related to the runtime status, configuration, and metadata of plugins.
  - Account and Password: Enter the high-privilege account and password that you used to create the databases.
- Redis config:
  - Host: Enter the internal IP address of the Redis instance. Go to the ApsaraDB for Redis console and obtain the address from the connection information section on the instance details page.
  - Port: The default is 6379. Enter the actual port if it is different.
  - Account and Password: Enter the account and password for the Redis instance.
- Elasticsearch configuration:
  - Host address: Enter the internal IP address of the Alibaba Cloud Elasticsearch instance. Go to the Alibaba Cloud Elasticsearch console, navigate to the instance details page, and get the address from the basic information section.
  - Port: The default is 9200. Enter the actual port if it is different.
  - Account and Password: Enter the username (default is elastic) and password for the Alibaba Cloud Elasticsearch instance. If you forget the password, you can reset it.
- Resource Specification: Select a PAI-EAS instance specification for the service. A specification with at least 8 CPUs and 16 GB of memory is recommended for stable operation.
After you confirm the configuration, click Deploy. When the service status changes to Running, the deployment is successful.

Step 3: Verify service status and access

After the service is successfully deployed, you can check its status and verify its functionality.

View Service Logs
If the service fails to start or runs abnormally, go to the service details page. In the Instance List, find the corresponding container component and click the Logs button next to it. Check the startup and runtime logs to identify the cause of the error.
Access the Dify Web Interface
On the service details page, click Web applications in the upper-right corner to open the Dify initialization page. After you create an administrator account, you can start using the application.
Call the API
After the Dify application is created, the base URL displayed on the API access page is an internal service address. In the Dify application, click Access API in the left-side navigation pane to view the Base URL. To call the Dify API from the public internet, you must replace the internal URL (e.g., http://******.console.cn-hangzhou.eas.pai-ml.com) with the public endpoint from the PAI-EAS service invocation information. In the Invocation Info dialog box for the service, switch to the Shared Gateway tab to obtain the Public Endpoint (the service URL used in the curl command), VPC endpoint, and token.
To interact with the application through the API, you must create an API Key. Click Access API in the left-side navigation pane. Then, click the API Keys button in the upper-right corner. In the dialog box that appears, click + Create Key to generate an API Key for Authorization: Bearer authentication in your API calls.
The following example shows how to send a message to a chatbot application by using a public API call:
```
curl -X POST 'http://xxxx.your_aliyun_account_id.cn-hangzhou.pai-eas.aliyuncs.com/v1/chat-messages' \
--header 'Authorization: Bearer app-xxxxxxxxxxxxx' \
--header 'Content-Type: application/json' \
--data-raw '{
    "inputs": {},
    "query": "Describe the main features of Dify",
    "response_mode": "blocking",
    "user": "test-user-001"
}'
```

Step 4: Advanced deployment with JSON

For automated or custom deployments, use a JSON configuration file. On the PAI-EAS service deployment page, switch to JSON Deployment and use the following template. This template defines all the containers, environment variables, storage mounts, and network configurations that Dify requires.

JSON configuration template

{
    "cloud": {
        "computing": {
            "instances": [
                {
                    "type": "$instance_type"
                }
            ]
        },
        "networking": {
            "security_group_id": "$security_group_id",
            "vpc_id": "$vpc_id",
            "vswitch_id": "$vswitch_id"
        }
    },
    "containers": [
        {
            "image": "eas-registry-vpc.cn-hangzhou.cr.aliyuncs.com/pai-eas/dify:nginx-0.2",
            "port": 80,
            "script": "sh /docker-entrypoint.sh"
        },
        {
            "env": [
                {
                    "name": "MODE",
                    "value": "api"
                },
                {
                    "name": "SECRET_KEY",
                    "value": "$secret_key"
                },
                {
                    "name": "PLUGIN_DIFY_INNER_API_KEY",
                    "value": "$api_key"
                },
                {
                    "name": "PLUGIN_DAEMON_KEY",
                    "value": "$plugin_daemon_key"
                },
                {
                    "name": "STORAGE_TYPE",
                    "value": "local"
                },
                {
                    "name": "STORAGE_LOCAL_PATH",
                    "value": "/mnt/dify/dify"
                },
                {
                    "name": "DB_HOST",
                    "value": "$db_host"
                },
                {
                    "name": "DB_PORT",
                    "value": "$db_port"
                },
                {
                    "name": "DB_DATABASE",
                    "value": "$api_db"
                },
                {
                    "name": "DB_USERNAME",
                    "value": "$db_username"
                },
                {
                    "name": "DB_PASSWORD",
                    "value": "$db_password"
                },
                {
                    "name": "REDIS_HOST",
                    "value": "$redis_host"
                },
                {
                    "name": "REDIS_PORT",
                    "value": "$redis_port"
                },
                {
                    "name": "REDIS_USERNAME",
                    "value": ""
                },
                {
                    "name": "REDIS_PASSWORD",
                    "value": "$redis_password"
                },
                {
                    "name": "REDIS_DB",
                    "value": "0"
                },
                {
                    "name": "CELERY_BROKER_URL",
                    "value": "redis://:$redis_password@$redis_host:$redis_port/1"
                },
                {
                    "name": "VECTOR_STORE",
                    "value": "elasticsearch"
                },
                {
                    "name": "ELASTICSEARCH_HOST",
                    "value": "$elasticsearch_host"
                },
                {
                    "name": "ELASTICSEARCH_PORT",
                    "value": "$elasticsearch_port"
                },
                {
                    "name": "ELASTICSEARCH_USERNAME",
                    "value": "$elasticsearch_username"
                },
                {
                    "name": "ELASTICSEARCH_PASSWORD",
                    "value": "$elasticsearch_password"
                }
            ],
            "image": "eas-registry-vpc.cn-hangzhou.cr.aliyuncs.com/pai-eas/dify:api-0.2",
            "port": 5001,
            "script": "/bin/bash /entrypoint.sh"
        },
        {
            "env": [
                {
                    "name": "MODE",
                    "value": "worker"
                },
                {
                    "name": "SECRET_KEY",
                    "value": "$secret_key"
                },
                {
                    "name": "PLUGIN_DIFY_INNER_API_KEY",
                    "value": "$api_key"
                },
                {
                    "name": "PLUGIN_DAEMON_KEY",
                    "value": "$plugin_daemon_key"
                },
                {
                    "name": "STORAGE_TYPE",
                    "value": "local"
                },
                {
                    "name": "STORAGE_LOCAL_PATH",
                    "value": "/mnt/dify/dify"
                },
                {
                    "name": "DB_HOST",
                    "value": "$db_host"
                },
                {
                    "name": "DB_PORT",
                    "value": "$db_port"
                },
                {
                    "name": "DB_DATABASE",
                    "value": "$api_db"
                },
                {
                    "name": "DB_USERNAME",
                    "value": "$db_username"
                },
                {
                    "name": "DB_PASSWORD",
                    "value": "$db_password"
                },
                {
                    "name": "REDIS_HOST",
                    "value": "$redis_host"
                },
                {
                    "name": "REDIS_PORT",
                    "value": "$redis_port"
                },
                {
                    "name": "REDIS_USERNAME",
                    "value": ""
                },
                {
                    "name": "REDIS_PASSWORD",
                    "value": "$redis_password"
                },
                {
                    "name": "REDIS_DB",
                    "value": "0"
                },
                {
                    "name": "CELERY_BROKER_URL",
                    "value": "redis://:$redis_password@$redis_host:$redis_port/1"
                },
                {
                    "name": "VECTOR_STORE",
                    "value": "elasticsearch"
                },
                {
                    "name": "ELASTICSEARCH_HOST",
                    "value": "$elasticsearch_host"
                },
                {
                    "name": "ELASTICSEARCH_PORT",
                    "value": "$elasticsearch_port"
                },
                {
                    "name": "ELASTICSEARCH_USERNAME",
                    "value": "$elasticsearch_username"
                },
                {
                    "name": "ELASTICSEARCH_PASSWORD",
                    "value": "$elasticsearch_password"
                }
            ],
            "image": "eas-registry-vpc.cn-hangzhou.cr.aliyuncs.com/pai-eas/dify:api-0.2",
            "script": "/bin/bash /entrypoint.sh"
        },
        {
            "env": [
                {
                    "name": "SERVER_KEY",
                    "value": "$plugin_daemon_key"
                },
                {
                    "name": "DIFY_INNER_API_KEY",
                    "value": "$api_key"
                },
                {
                    "name": "PLUGIN_STORAGE_TYPE",
                    "value": "local"
                },
                {
                    "name": "PLUGIN_STORAGE_LOCAL_ROOT",
                    "value": "/mnt/dify/dify_plugin"
                },
                {
                    "name": "DB_HOST",
                    "value": "$db_host"
                },
                {
                    "name": "DB_PORT",
                    "value": "$db_port"
                },
                {
                    "name": "DB_DATABASE",
                    "value": "$plugin_daemon_db"
                },
                {
                    "name": "DB_USERNAME",
                    "value": "$db_username"
                },
                {
                    "name": "DB_PASSWORD",
                    "value": "$db_password"
                },
                {
                    "name": "REDIS_HOST",
                    "value": "$redis_host"
                },
                {
                    "name": "REDIS_USERNAME",
                    "value": ""
                },
                {
                    "name": "REDIS_PASSWORD",
                    "value": "$redis_password"
                },
                {
                    "name": "REDIS_DB",
                    "value": "0"
                },
                {
                    "name": "REDIS_PORT",
                    "value": "$redis_port"
                }
            ],
            "image": "eas-registry-vpc.cn-hangzhou.cr.aliyuncs.com/pai-eas/dify:plugin-daemon-0.2",
            "port": 5002,
            "script": "/bin/sh /app/entrypoint.sh"
        },
        {
            "image": "eas-registry-vpc.cn-hangzhou.cr.aliyuncs.com/pai-eas/dify:web-0.2",
            "port": 3000,
            "script": "/bin/sh /app/web/entrypoint.sh"
        },
        {
            "image": "eas-registry-vpc.cn-hangzhou.cr.aliyuncs.com/pai-eas/dify:sandbox-0.2",
            "port": 8194,
            "script": "/main"
        },
        {
            "image": "eas-registry-vpc.cn-hangzhou.cr.aliyuncs.com/pai-eas/dify:squid-0.2",
            "port": 3128,
            "script": "sh /docker-entrypoint.sh"
        }
    ],
    "generate_token": false,
    "labels": {
        "EnableTrace": "true"
    },
    "metadata": {
        "cpu": 8,
        "enable_webservice": true,
        "instance": 1,
        "memory": 16000,
        "name": "dify_test",
        "workspace_id": "$workspace_id"
    },
    "storage": [
        {
            "mount_path": "/mnt/dify",
            "oss": {
                "path": "$oss_path",
                "readOnly": false
            }
        }
    ]
}

During deployment, replace the placeholders (prefixed with $) in the JSON template with your actual values. For detailed parameter descriptions, see JSON Deployment.

In the metadata section, you must set "enable_webservice": true to open the web access port.
In the storage section, replace $oss_path with the actual OSS path, for example, "oss://your-bucket-name/dify-data/". This path is used by the Dify API and plugins. Two subfolders, dify and dify_plugin, are created under this path.
In the containers section, the key environment variables that require placeholder replacement are described below. For more information, see Dify Environment Variables.
PostgreSQL database
- db_host: The endpoint of the PostgreSQL database instance.
- db_port: The default is 5432.
- api_db: The Dify core functions database. It stores all data related to core functions such as applications, users, conversations, knowledge bases, workflows, and model configurations.
- plugin_daemon_db: The Dify plugin database. It stores information related to plugin runtime status, configuration, and metadata.
- db_username and db_password: Both databases share one username and password.
Redis
When users have real-time conversations with the AI, Redis facilitates real-time messaging and communication between different service components.
- redis_host: The endpoint of the Redis instance.
- redis_port: The default is 6379.
- redis_password: The password set when you created the Redis instance.
Elasticsearch
Used for the vector database and full-text search engine.
- elasticsearch_host: The endpoint of the Elasticsearch instance.
- elasticsearch_port: The default is 9200.
- elasticsearch_username: The default is elastic.
- elasticsearch_password: The password configured when you created the Elasticsearch instance. If you forget the password, you can reset the instance access password.
Security keys
Dify uses several keys to secure internal communication. Generate them with the openssl rand -base64 42 command.
- secret_key: The key used to securely sign session cookies and encrypt sensitive information in the database.
- api_key: The key required for internal API access to prevent malicious external attacks.
- plugin_daemon_key: The key required for internal access to the plugin daemon to prevent malicious external attacks.

FAQ

Cannot connect to the database instance

[2025-09-13 00:46:28] [/bin/sh]: 2025/09/12 16:46:28 /app/internal/db/pg/pg.go:34
[2025-09-13 00:46:28] [/bin/sh]: [error] failed to initialize database, got error failed to connect to `host=pgm-xxxxxxxxxx.pg.rds.aliyuncs.com user=dify database=postgres`: dial error (timeout: dial tcp 10.0.0.230:5432: connect: connection timed out)
[2025-09-13 00:46:28] [/bin/sh]: 2025/09/12 16:46:28 init.go:95: [PANIC]failed to init dify plugin db: failed to connect to `host=pgm-xxxxxxxxxx.pg.rds.aliyuncs.com user=dify database=postgres`: dial error (timeout: dial tcp 10.0.0.230:5432: connect: connection timed out)
[2025-09-13 00:46:28] [/bin/sh]: panic: [PANIC]failed to init dify plugin db: failed to connect to `host=pgm-xxxxxxxxxx.pg.rds.aliyuncs.com user=dify database=postgres`: dial error (timeout: dial tcp 10.0.0.230:5432: connect: connection timed out)

Confirm that the ApsaraDB RDS for PostgreSQL instance and the PAI-EAS service are in the same VPC. ApsaraDB RDS for PostgreSQL does not support switching VPCs. You must recreate the instance in the correct VPC.

On the instance details page in the ApsaraDB RDS for PostgreSQL console, click Database Connection in the left-side navigation pane to view the VPC name and internal IP address of the instance. The default port is 5432.

Cannot connect to Redis

This issue occurs if the Redis client in the dify-api container cannot connect to the Redis server.

[2025-09-13 00:28:21] [/bin/sh]:   File "/app/api/.venv/lib/python3.12/site-packages/redis/utils.py", line 188, in wrapper
[2025-09-13 00:28:21] [/bin/sh]:     return func(*args, **kwargs)
[2025-09-13 00:28:21] [/bin/sh]:            ^^^^^^^^^^^^^^^^^^^^^
[2025-09-13 00:28:21] [/bin/sh]:   File "/app/api/.venv/lib/python3.12/site-packages/redis/connection.py", line 1530, in get_connection
[2025-09-13 00:28:21] [/bin/sh]:     connection.connect()
[2025-09-13 00:28:21] [/bin/sh]:   File "/app/api/.venv/lib/python3.12/site-packages/redis/connection.py", line 379, in connect
[2025-09-13 00:28:21] [/bin/sh]:     self.connect_check_health(check_health=True)
[2025-09-13 00:28:21] [/bin/sh]:   File "/app/api/.venv/lib/python3.12/site-packages/redis/connection.py", line 389, in connect_check_health
[2025-09-13 00:28:21] [/bin/sh]:     raise TimeoutError("Timeout connecting to server")
[2025-09-13 00:28:21] [/bin/sh]: redis.exceptions.TimeoutError: Timeout connecting to server
[2025-09-13 00:28:22] time="2025-09-12T16:28:22Z" level=info msg="program stopped with status:exit status 1" program=/bin/sh

Possible causes:

VPC network issue: Confirm that the Redis instance and the PAI-EAS service are in the same VPC.
On the Instance Information page of your ApsaraDB for Redis instance, check the Virtual Private Cloud field in the Basic Information section to confirm its VPC ID.
Allowlist setting issue: Confirm that an allowlist is configured for the Redis instance. You must add the IP address range of the vSwitch where the PAI-EAS service is located. You can find the IP address range on the vSwitch page.
For example, on the Allowlist Settings page, add the vSwitch CIDR block, such as 192.168.32.0/22, to an allowlist group.

Cannot connect to Alibaba Cloud Elasticsearch

A possible cause is a VPC network issue. Confirm that the Alibaba Cloud Elasticsearch instance and the PAI-EAS service are in the same VPC.

On the Basic Information page of the Alibaba Cloud Elasticsearch instance, check the Virtual Private Cloud field to get the instance's VPC ID.

Missing database for dify-api

When Dify starts, it connects to two databases: the core data database required by dify-api and the plugin database required by dify-plugin.

[2025-09-13 01:33:20] [/bin/sh]:   File "/app/api/.venv/lib/python3.12/site-packages/sqlalchemy/engine/default.py", line 625, in connect
[2025-09-13 01:33:20] [/bin/sh]:     return self.loaded_dbapi.connect(*cargs, **cparams)  # type: ignore[no-any-return]  # NOQA: E501
[2025-09-13 01:33:20] [/bin/sh]:            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
[2025-09-13 01:33:20] [/bin/sh]:   File "/app/api/.venv/lib/python3.12/site-packages/psycopg2/__init__.py", line 122, in connect
[2025-09-13 01:33:20] [/bin/sh]:     conn = _connect(dsn, connection_factory=connection_factory, **kwasync)
[2025-09-13 01:33:20] [/bin/sh]:            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
[2025-09-13 01:33:20] [/bin/sh]:   File "/app/api/.venv/lib/python3.12/site-packages/psycogreen/gevent.py", line 32, in gevent_wait_callback
[2025-09-13 01:33:20] [/bin/sh]:     state = conn.poll()
[2025-09-13 01:33:20] [/bin/sh]:             ^^^^^^^^^^^
[2025-09-13 01:33:20] [/bin/sh]: sqlalchemy.exc.OperationalError: (psycopg2.OperationalError) FATAL:  database "dify_core" does not exist
[2025-09-13 01:33:20] [/bin/sh]:

In Dify Community Edition 1.7.1, which is used for this deployment, the plugin database is created automatically, but the core data database is not. You must create the core data database manually.

Cannot connect to marketplace.dify.ai

This issue occurs because PAI-EAS containers lack public internet access by default. For a solution, see Enable a PAI-EAS service to access public or internal resources.

[2025-09-13 00:00:00] [/bin/sh]: 2025-09-12 16:00:00,847.847 WARNING [Dummy-1] [ssrf_proxy.py:81] - Request to URL https://marketplace.dify.ai/api/v1/plugins/download?unique_identifier=langgenius/tongyi:0.0.46@8e73008929dbc3934936493d442fab4c34ef016ae817b144b45da278ba76580e failed on attempt 1: timed out
[2025-09-13 00:00:02] [/bin/sh]: 2025-09-12 16:00:02,046.046 WARNING [Dummy-2] [ssrf_proxy.py:81] - Request to URL https://marketplace.dify.ai/api/v1/plugins/download?unique_identifier=langgenius/tongyi:0.0.46@8e73008929dbc3934936493d442fab4c34ef016ae817b144b45da278ba76580e failed on attempt 1: timed out
[2025-09-13 00:00:06] [/bin/sh]: 2025-09-12 16:00:06,416.416 WARNING [Dummy-1] [ssrf_proxy.py:81] - Request to URL https://marketplace.dify.ai/api/v1/plugins/download?unique_identifier=langgenius/tongyi:0.0.46@8e73008929dbc3934936493d442fab4c34ef016ae817b144b45da278ba76580e failed on attempt 2: timed out
[2025-09-13 00:00:07] [/bin/sh]: 2025-09-12 16:00:07,614.614 WARNING [Dummy-2] [ssrf_proxy.py:81] - Request to URL https://marketplace.dify.ai/api/v1/plugins/download?unique_identifier=langgenius/tongyi:0.0.