A content backend for teams with separate frontends
Strapi lets developers define articles, products, authors, or other content types while editors manage entries in a browser. The same model becomes REST and GraphQL APIs for websites, mobile apps, kiosks, or devices. Roles, permissions, uploads, internationalization, drafts, publishing, and a media library arrive as CMS features instead of an application backlog.
Editors avoid database access and Git, while developers keep control of routes, middleware, controllers, services, and the admin interface. SQLite makes a local project quick; PostgreSQL, MySQL, and MariaDB are available for production. TypeScript is a supported path rather than an outside add-on.
Headless still means the customer-facing site is separate. A team must build previews, caching, search, and frontend deployments around the content API. That freedom suits product engineering groups and adds needless architecture to a simple marketing site that would be happier in an integrated builder.
What happened when we ran it
We cloned commit e5f3785 into an unprivileged Debian container with 3 CPUs and 8 GB of RAM. This is a large monorepo: 6,546 files, about 641,470 lines of source, and a 69.2 MB checkout. Yarn installation succeeded in 199 seconds, adding 3,991 packages and consuming 1,293 MB.
The build did not complete within our 900-second limit. Near the end, Yarn repeatedly printed Internal Error: spawn /usr/local/bin/node EAGAIN, followed by build:types:server exiting with code 1 while Nx type builds were still being scheduled. This is a timed-out and failed build in our environment. The tail does not prove whether process limits, project behavior, or another condition caused it.
Our harness found no single test script or target, so tests were skipped. The repository does contain a tests directory and 28 CI workflow files. Those signals show internal test infrastructure, but we did not run it and will not imply a passing result.
The user quick start is a different workload
Running npx create-strapi@latest my-project produces an application with an admin panel, content modeling, authentication, permissions, and upload support. A developer can define a collection and query it from an API without learning the 639,000-line core repository. The visual Content-Type Builder is especially useful when editors and engineers need to discuss a schema together.
Customization goes beyond the UI. Requests flow through documented backend layers, and plugins can extend the server and admin panel. That flexibility also ties the application to Strapi's content models, lifecycle behavior, permissions, and plugin APIs. Prototype the hardest relationship, localization rule, preview flow, and authorization case before committing a large content graph.
A confirmed issue exposes a current quick-start boundary. Strapi declares Node 26 support, but issue 27354 says the SQLite scaffold pins a better-sqlite3 release whose engine range excludes Node 26. Until that changes, use a documented compatible Node version or another database and verify the generated app's install.
Self-hosting is an operations choice
Production Strapi is a public Node service with a database and uploaded assets. Operators need stable secrets, a supported runtime, durable media storage, a reverse proxy, TLS, logs, monitoring, backups, and restore tests. CORS, API tokens, admin access, rate limits, and upload restrictions must match the deployment.
Strapi does not publish an official Docker image. Its README points to a community tool that generates a Dockerfile and Compose setup, or operators can build from the deployment guide. That is workable, but the team owns the image and upgrade path. Strapi Cloud is the simpler choice when maintaining the database, assets, and CDN is unwanted.
Release 5.52.2 changed generated projects to block SVG uploads by default because SVG can carry active browser content. Existing projects are unchanged. Operators should still define the allowed upload types, size limits, storage policy, and serving headers their application requires.
Third-party plugins require their own review. Strapi's security scope covers current core packages and the bundled admin panel, not marketplace plugins. Record each plugin's maintainer, supported Strapi range, data access, and removal plan.
Open core terms and current extras
GitHub cannot reduce the repository to one standard license identifier. The root license grants MIT Expat terms to Community Edition use under stated conditions, while software inside ee/ directories has a separate Enterprise Edition license unless another agreement or Cloud subscription applies. Map required features to those terms before procurement or deep customization.
Strapi now includes an AI layer and an Enterprise MCP server. The core CMS should be evaluated separately from those additions. Confirmed issue 27395 says the MCP server advertises draft-07 schemas, causing strict clients that expect JSON Schema 2020-12 to reject every tool. That is a specific blocker for some agent integrations, not a verdict on content APIs.
Health and the decision
Version 5.52.2 shipped on August 26, 2026, and the repository was pushed on August 26. GitHub listed 544 open issues and pull requests combined, with confirmed reports receiving current triage. Only stable Strapi 5 releases are supported; version 4 security support ended in April 2026. Self-hosters need an upgrade routine, not a set-and-forget deployment.
Strapi is a strong editorial CMS when a team needs a visual admin and adaptable APIs. Its convenience shifts work rather than removing it: the frontend, production hardening, plugins, storage, and upgrades stay with the operator. That bargain is reasonable for a maintained product platform and excessive for a small site.