---
title: "Self-hosting"
description: "The whole thing on your infrastructure with Docker Compose. Same engine, same images as our cloud."
canonical: https://past.dev/docs/memory-api/self-hosting
last-updated: 2026-08-26
---
# Self-hosting

> The whole thing on your infrastructure with Docker Compose. Same engine, same images as our cloud.

Product: past.dev Memory API. Source: https://past.dev/docs/memory-api/self-hosting

One `docker compose up -d` runs the past API, the web console, Postgres with pgvector, and Redis; a `temporal` profile adds background jobs. Configuration is env-var based and every setting has a working default: the bundle runs with **no account on any third-party service**. The one optional credential is OpenAI, and only embedding features depend on it.

### Accounts stay in your database

Sign-in is email and password, stored in your own Postgres, no identity vendor involved. The first account registered is the owner; registration then closes unless you set `PAST_ALLOW_REGISTRATION=true`. If you want SSO or MFA instead, set `PAST_AUTH_MODE=WorkOs` with your own WorkOS credentials.

### Releases and upgrades

Released images are public and pinned by exact version. Never run latest: pin, and verify what a deployment runs from `/health`, whose version always equals the image tag.

```.env
PAST_IMAGE=public.ecr.aws/iteration-x/past:0.1.1
PAST_WEB_IMAGE=public.ecr.aws/iteration-x/past-web:0.1.1
```

- **Migrations ship inside the API image** and apply on startup, forward-only. Skipping releases is fine; going backwards means restoring a backup.
- **Failure is loud.** A migration that cannot apply makes the API refuse to serve rather than run on a half-migrated schema.
- **Upgrade** is back up, bump the pins, pull, restart, verify `/health`. **Rollback** is restore plus repin.
- The cloud tier runs the same two containers the bundle does, so self-host is not a fork of the product.

> **Getting the bundle**
>
> The compose bundle ships to design partners during early access, with the upgrade and backup runbook. Ask when requesting access, or any time after.