diff --git a/postgres/docker/Dockerfile b/postgres/docker/Dockerfile
new file mode 100644
index 0000000..4b4874f
--- /dev/null
+++ b/postgres/docker/Dockerfile
@@ -0,0 +1,7 @@
+FROM postgres:15-alpine
+
+COPY entrypoint /sa-entrypoint
+RUN chmod 544 /sa-entrypoint
+
+ENTRYPOINT ["/bin/sh", "/sa-entrypoint"]
+CMD ["postgres"]
diff --git a/postgres/docker/entrypoint b/postgres/docker/entrypoint
new file mode 100644
index 0000000..311a019
--- /dev/null
+++ b/postgres/docker/entrypoint
@@ -0,0 +1,17 @@
+#!/bin/sh
+
+set -e
+
+export POSTGRES_PASSWORD=$(mktemp -u XXXXXXXXXXXXXXXX)
+
+kc_secret=/tmp/passwd/keycloak/secret
+{
+    if [ ! -f ${kc_secret} ]; then
+        mkdir -p $(dirname ${kc_secret})
+        echo $(mktemp -u XXXXXXXXXXXXXXXX) >${kc_secret}
+    fi
+    chown root:postgres ${kc_secret}
+    chmod 440 ${kc_secret}
+}
+
+exec docker-entrypoint.sh "$@"