Serverless CMS Starter — a headless CMS in two forms, self-hosted and on the edge

Engineering & Development

A self-hosted headless CMS: docker compose up brings a single container up, and logging in gives you the admin back office — content types, a media library, user permissions, a plugin framework and a REST API; the same source can also be deployed to your own Cloudflare Workers. A frozen snapshot of an MIT upstream, with a Traditional Chinese quick-start guide.

Subscribe & download See how to start

SubscriptionUS$49 per month

Last run2026-11-02

In practice

Readiness4 / 5

What you need

Few changes needed3 / 5

Who it is for

Developers and small teams who want to self-host a headless CMS and still keep the option of moving it onto the edge later, and who do not want to build the admin back office, the permissions and the media library themselves from scratch.

How to start

$ scripts/init-env.sh
$ docker compose up -d --build

Browse the files

Files in the product repository at the pinned commit. A few house files are left out of the zip.

File overview1,405 paths

▸demos21

employee-directory/

▸docs118

AUTH_CONFIGURABLE_FIELDS.md
FORMIO_COMPONENTS_CONFIG.md
FORMIO_INTEGRATION_PLAN.md
FORMIO_KITCHEN_SINK_REFERENCE.md
FORMIO_TURNSTILE_COMPLETE_SUMMARY.md
FORMIO_WIZARD_FORMS.md
FORMS_API.md
FORMS_COMPLETE_SUMMARY.md
FORMS_EMBEDDING_GUIDE.md
FORMS_EXAMPLES.md
…

▸my-sonicjs-app68

.dev.vars.example
.gitignore
README.md
migrations/
package.json
pnpm-lock.yaml
scripts/
src/
test-results/
tsconfig.json
…

▸packages663

core/
create-app/
scripts/
sdk/
stats/
templates/

▸scripts15

dev-demo.sh
gen-conf.integration.mjs
init-env.sh
notify-discord.js
release/
social/
sync-versions.js

▸tests152

QUICK_START.md
SMOKE_TESTS.md
e2e/
playwright-no-server.config.ts
playwright-report-smoke/
playwright.config.ts
playwright.smoke.config.ts
postman/

▸www306

.cloudflare-settings.md
.eslintrc.json
.gitignore
.node-version
.nvmrc
CHANGELOG.md
DEPLOYMENT.md
FIX-DEPLOYMENT-ERROR.md
LICENSE.md
MONOREPO.md
…

▫AGENTS.md

▫ATTRIBUTION.md

▫CLAUDE.md

▫CODING_STANDARDS.md

▫CONTRIBUTING.md

▫Dockerfile

▫GOVERNANCE.md

▫LICENSE

▫LICENSE-99LL

▫PLUGIN_FRAMEWORK_CONVERGENCE_PLAN.md

▫PLUGIN_FRAMEWORK_DEV_PLAN.md

▫PLUGIN_SYSTEM_OVERHAUL_PLAN.md

▫PRODUCT.md

▫PUBLISHING.md

▫QUICKSTART.md

▫README.md

▫SECURITY.md

▫delivery-manifest.txt

▫docker-compose.yml

▫docker-entrypoint.sh

▫package-lock.json

▫package.json

▫project-plan.md

▫tsconfig.json

▫vitest.config.ts

▫Config and hidden files 37

Latest passing run

Clone → Checkout → Toolchain → Build → Run live

Pre-purchase Disclosure

What you are buying

A containerised, self-hosted headless CMS: content types, an admin back office, a media library, user permissions, a plugin framework and a REST API, with docker compose up bringing a single container up.

A derived and reworked version built on an open-source CMS under the MIT licence: upstream’s self-hosted Docker path did not come up at all, and we fixed four defects to the point where it starts and you can log in; the same source can also be deployed to your own Cloudflare Workers. Delivery is a frozen snapshot: one zip, taken from the product repository at revision 9f3b56c.

Known limitations

No TLS termination is included: compose opens a single port over plain HTTP, so putting it on the public internet needs your own domain and reverse proxy
The default administrator credentials are publicly known values ([email protected] / sonicjs!)
Mail sending (SendGrid) and Cloudflare Images are optional, and without your own keys those features are not enabled
The database and the media files both live in a Docker volume, and docker compose down -v deletes the whole thing
The first start builds from source: it fetches from Docker Hub, the Alpine package repository and npm, so it cannot be built offline
The web pages of the login page and the admin back office load scripts and stylesheets from third-party CDNs (cdn.tailwindcss.com, unpkg.com and others)
When you log in with the default administrator account the server sends one event to stats.sonicjs.com, and it does not look for an environment variable to disable telemetry
Pinned to the delivered snapshot; it does not follow upstream.

The liability cap, the scope of what is promised and the statutory floor are governed by the Terms of Service.

Vetting record

Everything below was checked against the pinned commit 16980e7. Every verdict carries its full reasoning, an evidence link and the checker; failures are published, not hidden — do not take our word for it, verify it yourself.

3 PASS2 WARN0 FAIL

Source ReviewWARN

Not every file was read — the delivered tree (a monorepo: the core package, an example app and demos) is beyond the scope of a file-by-file review, so this is flagged as uncertain, rather than pretending it was checked. What was actually done: (a) a pattern scan of the whole tree for eval / new Function / child_process — plugins/plugin-validator.ts:411, which is a defensive check (detecting whether plugin code contains eval) and not a point of execution; (c) the start-up path was tested line by line all the way to a successful administrator login; (d) the three .env* files under version control were each opened and confirmed to hold only placeholder values (sk_your_key_here) and public demo addresses, with no real key.

Script SafetyPASS

The only install-time script in the root package.json is prepare: husky (installing git hooks, a development toolchain convention), with no preinstall or postinstall; the container entrypoint (docker-entrypoint.sh) does nothing more than "run the seed only if the DB file does not exist, then start the server", logic short enough to read in under ten lines, and it makes no outbound connection.

RecencyPASS

Checked on the day of vetting (2026): upstream was not archived; the derived repository is pinned at 16980e7 and does not follow upstream.

LicensePASS

SPDX:LicenseRef-99LL-Product

Upstream is MIT: the LICENSE itself at the pinned commit 16980e736f58d7911d1932fda2d53eaffbb24f0e was read word for word (the standard full text of the MIT licence, Copyright 2024 Lane Campbell and SonicJS contributors), and the root LICENSE is kept as it stands; our sale terms are LICENSE-99LL (the 99LL product licence template v1).

Dependency LicensesWARN

The dependency tree is large (a monorepo: hono, drizzle-orm, the better-auth family, better-sqlite3, zod, marked, highlight.js and others, with nested workspace installs), and each package's licence file was not opened and checked word for word one by one, so the licence status is flagged as uncertain — an honest statement of how deep the check went. The base image node:22-alpine is distributed with the image under its own licence and does not go into the buyer's zip (the zip delivers the source tree).