Immich

Set up the project folder

Immich runs as four containers working together: the main server, a machine-learning service for face and object recognition, a cache (Redis), and a Postgres database with a vector-search extension built in, so you can't swap in a plain, stock Postgres image. Create a folder, and inside it a .env file:

UPLOAD_LOCATION=./library
DB_DATA_LOCATION=./postgres
IMMICH_VERSION=v2.1.0
DB_PASSWORD=changeThisToARandomPassword123
DB_USERNAME=postgres
DB_DATABASE_NAME=immich

Change DB_PASSWORD to a random password of your own, using only letters and numbers. Punctuation in this particular password can break how Docker reads the file. Also note IMMICH_VERSION here: Immich's own docs recommend pinning it to a specific release like this, rather than leaving it on "always latest," so the mobile app and server upgrade together deliberately instead of drifting apart.

Write the compose file

Save this as docker-compose.yml in the same folder. It joins the shared web network on immich-server instead of publishing port 2283 directly, so it can sit behind a reverse proxy; the domains and HTTPS deep dive covers what that network is and why every tool on this site uses it.

name: immich
services:
  immich-server:
    container_name: immich_server
    image: ghcr.io/immich-app/immich-server:${IMMICH_VERSION:-release}
    security_opt:
      - no-new-privileges:true
    volumes:
      - ${UPLOAD_LOCATION}:/data
      - /etc/localtime:/etc/localtime:ro
    env_file:
      - .env
    depends_on:
      - redis
      - database
    restart: always
    healthcheck:
      disable: false
    networks:
      - default
      - web

  immich-machine-learning:
    container_name: immich_machine_learning
    image: ghcr.io/immich-app/immich-machine-learning:${IMMICH_VERSION:-release}
    security_opt:
      - no-new-privileges:true
    volumes:
      - model-cache:/cache
    env_file:
      - .env
    restart: always
    healthcheck:
      disable: false

  redis:
    container_name: immich_redis
    image: docker.io/valkey/valkey:9
    security_opt:
      - no-new-privileges:true
    healthcheck:
      test: ["CMD-SHELL", "redis-cli ping | grep -q PONG || exit 1"]
    restart: always

  database:
    container_name: immich_postgres
    image: ghcr.io/immich-app/postgres:14-vectorchord0.4.3-pgvectors0.2.0
    security_opt:
      - no-new-privileges:true
    environment:
      POSTGRES_PASSWORD: ${DB_PASSWORD}
      POSTGRES_USER: ${DB_USERNAME}
      POSTGRES_DB: ${DB_DATABASE_NAME}
      POSTGRES_INITDB_ARGS: '--data-checksums'
    volumes:
      - ${DB_DATA_LOCATION}:/var/lib/postgresql/data
    shm_size: 128mb
    restart: always

networks:
  web:
    external: true

volumes:
  model-cache:

Then start everything: docker compose up -d. The first start takes a few minutes.

Wire it into the shared reverse proxy

This site uses one Caddy instance for the whole server, not one per app, and every tool guide points back to the same setup rather than each showing its own. If you haven't set it up yet, the domains and HTTPS deep dive is the canonical walkthrough, including the exact port and Caddyfile block for every tool on this site. Once it's running, connecting Immich is one block in the shared Caddyfile:

photos.yourdomain.com {
    reverse_proxy immich-server:2283
}

Then reload it: docker compose restart caddy in the proxy's folder.

Create your account

Visit your domain and click "Getting Started." There's no separate setup wizard: the first account you register becomes the admin account, full stop.

Install the apps and turn on backup

One real caveat worth knowing up front: the iOS app is currently distributed through Apple's TestFlight beta program, not a normal App Store listing. That's Immich's own current distribution choice, not a mistake on your end. In the app, enter your server address and log in, then turn on background backup in settings so new photos upload automatically.