DockerImmich

KO | EN

gitlite — search

#typescript #ai-agents #ai #dsh-plugin #deepseek-harness #open-source #claude-code #codex #cli #developer-tools #react #windows

★ 53 Open GitHub ↗

Custom Docker Compose stack for self-hosted Immich - an open-source photo and video management solution including traefik for Let's Encrypt certificates.

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# DockerImmich

Custom Docker Compose stack for self-hosted [Immich](https://immich.app) - an open-source photo and video management solution including traefik for Let's Encrypt certificates.

## Table of Contents

- [Overview](#overview)
- [What's customized](#whats-customized)
- [Stack](#stack)
- [Setup](#setup)
  - [TLS certificates](#tls-certificates)
- [Upgrade](#upgrade)
- [Versioning](#versioning)
- [License](#license)

## Overview

This repo tracks the configuration for an Immich instance running inside a Proxmox LXC container 
(as a root and I don't care about it because it's a LXC isolated and dedicated LXC container exclusively for Immich) in /docker.
It is a **lightly customized version** of the [official Immich Docker Compose setup](https://docs.immich.app/install/docker-compose/) 
- worth comparing the two side by side before adapting this for your own deployment.

Hardware requirement: for this setup an Intel iGPU exposed as `/dev/dri` as `dev0` and `dev1` in my LXC container configuration on the host (Zimaboard2) 
used for both QuickSync transcoding and OpenVINO machine learning acceleration. 
Without it, drop the `hwaccel.*.yml` extends in `compose.yml` and the stack runs on CPU only.

> I show my LXC container config as a example, you can run this stack wherever you want.

```bash
root@zima01:~# cat /etc/pve/lxc/122.conf
arch: amd64
cores: 4
dev0: /dev/dri/card0,gid=44
dev1: /dev/dri/renderD128,gid=992
features: keyctl=1,nesting=1
hostname: immich
memory: 16384
net0: name=eth0,bridge=ovsbr0,firewall=1,hwaddr=XX:XX:XX:XX:XX:XX,ip=dhcp,tag=250,type=veth
onboot: 1
ostype: debian
parent: pre-sanitize
rootfs: zimapool01:subvol-122-disk-0,size=520G
startup: order=7,up=60
swap: 8192
tags:  
unprivileged: 1
```

> A word of warning: with Intel/QuickSync + OpenVINO on my ZimaBoard 2, the initial loading of many files can result in high CPU usage, so uploading in batches/chunks is recommended based on your preference. On other setups with more powerful GPUs, this shouldn't be an issue. 
> the compose.yml published here use my real endpoint for immich.marvin.ar, You'll need to edit those values and adjust them to your needs.

## What's customized

- **`compose.yml`** - based on the [official docker-compose.yml](https://github.com/immich-app/immich/releases/latest/download/docker-compose.yml), extended with:
  - Traefik reverse proxy with automatic HTTPS (Let's Encrypt via Cloudflare DNS challenge)
  - Intel QuickSync hardware transcoding
  - Intel OpenVINO hardware-accelerated machine learning
  - Redis replaced by [Valkey](https://valkey.io) 8-alpine
  - Postgres image pinned independently of `IMMICH_VERSION` (see table below)

- **`.env`** - based on the [official example.env](https://github.com/immich-app/immich/releases/latest/download/example.env). Not tracked in this repo (contains credentials) - see [Setup](#setup).

## Stack

| Service | Image |
|---|---|
| immich-server | `ghcr.io/immich-app/immich-server:release` |
| immich-machine-learning | `ghcr.io/immich-app/immich-machine-learning:release-openvino` |
| immich-postgres | `ghcr.io/immich-app/postgres:16-vectorchord0.5.3` (pinned) |
| immich-redis | `valkey/valkey:8-alpine` |
| traefik | `traefik:v3` |

> The Postgres image is pinned independently of `IMMICH_VERSION`. Check Immich release notes when upgrading - it may require a manual update in `compose.yml`.

## Setup

```bash
git clone <this-repo> /docker
cd /docker
cp .env.example .env
# edit .env: set DB_PASSWORD, CLOUDFLARE_DNS_API_TOKEN, ACME_EMAIL, etc.
docker compose pull
docker compose up -d
```

### TLS certificates

`traefik/certs/` is intentionally empty in this repo - certificate and key files are never committed. 
Traefik's public router (`immich.marvin.ar`) gets its certificate automatically via the Cloudflare DNS challenge; no manual cert is needed for that. 
And it's protected behind self-hosted app routed over Cloudflared tunnel + policies and aren't covered in this repo. 
But here: [Can't get past ClouldFlare Zero Trust on Mobile? Do THIS!](https://www.youtube.com/watch?v=J4vVYFVWu5Q) you can get the config I used.

The local router (`immich.lan`, currently disabled in `compose.yml`) expects a cert/key pair plus a `traefik/certs/immich.lan.toml` file (already tracked) pointing at them. 
To generate a local CA and issue that pair, see [Mstaaravin/Certgen](https://github.com/Mstaaravin/Certgen).

## Upgrade

```bash
cd /docker && docker compose pull && docker compose up -d
```

`IMMICH_VERSION=release` is a floating tag - no `.env` edits needed for standard upgrades.

## Versioning

Git tags track deployed Immich versions: `immich-vX.Y.Z` on `main`.

## License

[MIT](LICENSE)

DockerImmich

Explore Similar Repositories

Was this content helpful?

Recent Feedback

Download README