@rubys is the best writer here, by a wide margin, and I was pleased to see him posting again.
(There used to be several drifting down each day. Like the orange leaves in the fall up here.)
Perhaps you glossed over his earlier response’s most important part, though, two days ago?
I.e., migrations are factored out of the main build process and execute apart, in their own special context.
Cantankerous individuals like myself go further and construct our own builders—in part to have complete control over the exact nitty details of what network access is and [usually more importantly] is not allowed. (I’m using Guix, but he gave the easier RCHAB example.)
That’s a project in its own right, though, so stick with the Fly.io platform feature that was designed specifically for performing migrations, unless there really is a compelling reason to do otherwise…