Self-host Payload

copy# Payload has no prebuilt image: scaffold the blank template (pinned to 3.90.2) with Postgres, then build it with the template's own Dockerfile
PGPASS=$(openssl rand -hex 16)
docker run --rm -v "$PWD":/work -w /work -u "$(id -u):$(id -g)" -e HOME=/tmp node:22.17.0-alpine npx --yes create-payload-app@3.90.2 payload-app --template blank --db postgres --db-connection-string "postgresql://payload:$PGPASS@postgres:5432/payload" --version 3.90.2 --use-npm --no-git --no-agent
cd payload-app
# the template's Dockerfile needs standalone output, a public/ folder, and the template's .npmrc (it sets legacy-peer-deps, which `npm ci` needs)
sed -i "s|const nextConfig: NextConfig = {|&\n  output: 'standalone',|" next.config.ts
sed -i "s|^COPY package.json yarn.lock|COPY .npmrc package.json yarn.lock|" Dockerfile
# uploads are written to ./media, which the unprivileged runtime user cannot create: give it a folder and a volume
sed -i "s|^USER nextjs|RUN mkdir media \&\& chown nextjs:nodejs media\nUSER nextjs|" Dockerfile
mkdir -p public && printf "node_modules\n.next\n" > .dockerignore
cat > docker-compose.yml <<EOF
services:
  payload:
    build: .
    env_file: .env
    ports:
      - "3000:3000"
    volumes:
      - media:/app/media
    depends_on:
      - postgres
  postgres:
    image: postgres:17-alpine
    environment:
      POSTGRES_USER: payload
      POSTGRES_PASSWORD: $PGPASS
      POSTGRES_DB: payload
    volumes:
      - pgdata:/var/lib/postgresql/data
volumes:
  pgdata:
  media:
EOF
# Postgres needs a migration in production (schema push is dev-only): create and apply the first one, then build and start
docker compose up -d postgres
docker run --rm --network payload-app_default -v "$PWD":/app -w /app -u "$(id -u):$(id -g)" -e HOME=/tmp node:22.17.0-alpine sh -c "npm run payload migrate:create initial && npm run payload migrate"
docker compose up -d --build
# open http://SERVER_IP:3000/admin and create the first admin user