fix: dockerfile

apps/cms/Dockerfile

@@ -1,11 +1,11 @@
 # syntax=docker/dockerfile:1.7
 #
 # PayloadCMS production image. Built and run by docker-compose.
-# `corepack` reads the `packageManager` field from apps/cms/package.json
-# so we don't pin a version here.
+# We install pnpm globally via npm so we don't depend on corepack's
+# (sometimes strict) version negotiation.
 
 FROM node:20-alpine AS base
-RUN corepack enable
+RUN npm install -g [email protected]
 WORKDIR /repo
 
 # ---- deps -----------------------------------------------------------------
@@ -16,7 +16,6 @@ FROM base AS deps
 COPY pnpm-workspace.yaml package.json ./
 COPY apps/cms/package.json ./apps/cms/package.json
 COPY apps/web/package.json ./apps/web/package.json
-# pnpm-lock.yaml is generated locally; fall back gracefully on first build.
 COPY pnpm-lock.yaml* ./
 RUN if [ -f pnpm-lock.yaml ]; then \
       pnpm install --frozen-lockfile; \

apps/cms/package.json

@@ -3,6 +3,7 @@
   "version": "0.1.0",
   "private": true,
   "type": "module",
+  "packageManager": "[email protected]",
   "scripts": {
     "dev": "cross-env NODE_OPTIONS=--no-deprecation payload dev",
     "build": "cross-env NODE_OPTIONS=--no-deprecation payload build",

apps/web/Dockerfile

@@ -8,11 +8,11 @@
 # image (e.g. for a registry). For the normal homeserver flow, this image
 # is never built.
 #
-# `corepack` reads the `packageManager` field from apps/web/package.json
-# so we don't pin a version here.
+# We install pnpm globally via npm to avoid corepack's strict version
+# negotiation across Node 20 minor versions.
 
 FROM node:20-alpine AS base
-RUN corepack enable
+RUN npm install -g [email protected]
 WORKDIR /repo
 
 FROM base AS deps