Share Immich photos and albums publicly without exposing the Immich instance itself.
| Port | 3000 |
| Registry | ghcr.io/daemonless/immich-public-proxy |
| Source | https://github.com/alangrainger/immich-public-proxy |
| Website | https://github.com/alangrainger/immich-public-proxy |
| Tag | Description | Best For |
|---|---|---|
latest |
Upstream Binary. Built from official release. | Most users. Matches Linux Docker behavior. |
Before deploying, ensure your host environment is ready. See the Quick Start Guide for host setup instructions.
services:
immich-public-proxy:
image: "ghcr.io/daemonless/immich-public-proxy:latest"
container_name: immich-public-proxy
environment:
- IMMICH_URL=http://your-internal-immich-server:2283 # URL of your (private) Immich instance, e.g. http://immich-server:2283
- PUBLIC_BASE_URL=https://your-proxy-url.com # Public base URL this proxy is served from, no trailing slash (optional - derived from the request hostname if unset)
- TZ=UTC # Timezone for the container
- IPP_PORT= # Internal webserver port (default 3000)
ports:
- "3000:3000"
restart: unless-stopped.env:
# .env
DIRECTOR_PROJECT=immich-public-proxy
IMMICH_URL=http://your-internal-immich-server:2283
PUBLIC_BASE_URL=https://your-proxy-url.com
TZ=UTC
IPP_PORT=
appjail-director.yml:
# appjail-director.yml
options:
- virtualnet: ':<random> default'
- nat:
services:
immich-public-proxy:
name: immich_public_proxy
options:
- container: 'boot args:--pull'
- expose: '3000:3000 proto:tcp' \
oci:
user: root
environment:
- IMMICH_URL: !ENV '${IMMICH_URL}'
- PUBLIC_BASE_URL: !ENV '${PUBLIC_BASE_URL}'
- TZ: !ENV '${TZ}'
- IPP_PORT: !ENV '${IPP_PORT}'Makejail:
# Makejail
ARG tag=latest
OPTION overwrite=force
OPTION from=ghcr.io/daemonless/immich-public-proxy:${tag}
Note: Exposing ports in AppJail means that your service can be reached from remote hosts. If that is not your intention, do not expose the ports and communicate with the service using the IPv4 address assigned by the virtual network.
podman run -d --name immich-public-proxy \
-p 3000:3000 \
-e IMMICH_URL=http://your-internal-immich-server:2283 \
-e PUBLIC_BASE_URL=https://your-proxy-url.com \
-e TZ=UTC \
-e IPP_PORT= \
ghcr.io/daemonless/immich-public-proxy:latestappjail oci run -Pd \
-o overwrite=force \
-o container="args:--pull" \
-o virtualnet=":<random> default" \
-o nat \
-o expose="3000:3000 proto:tcp" \
-e IMMICH_URL=http://your-internal-immich-server:2283 \
-e PUBLIC_BASE_URL=https://your-proxy-url.com \
-e TZ=UTC \
-e IPP_PORT= \
ghcr.io/daemonless/immich-public-proxy:latest immich-public-proxyNote: Exposing ports in AppJail means that your service can be reached from remote hosts. If that is not your intention, do not expose the ports and communicate with the service using the IPv4 address assigned by the virtual network.
- name: Deploy immich-public-proxy
containers.podman.podman_container:
name: immich-public-proxy
image: "ghcr.io/daemonless/immich-public-proxy:latest"
state: started
restart_policy: always
env:
IMMICH_URL: "http://your-internal-immich-server:2283"
PUBLIC_BASE_URL: "https://your-proxy-url.com"
TZ: "UTC"
IPP_PORT: ""
ports:
- "3000:3000"Access at: http://localhost:3000
| Variable | Default | Description |
|---|---|---|
IMMICH_URL |
http://your-internal-immich-server:2283 |
URL of your (private) Immich instance, e.g. http://immich-server:2283 |
PUBLIC_BASE_URL |
https://your-proxy-url.com |
Public base URL this proxy is served from, no trailing slash (optional - derived from the request hostname if unset) |
TZ |
UTC |
Timezone for the container |
IPP_PORT |
`` | Internal webserver port (default 3000) |
| Port | Protocol | Description |
|---|---|---|
3000 |
TCP | Web UI |
This image is part of the Immich Stack.
Architectures: amd64
User: bsd (UID/GID via PUID/PGID, defaults to 1000:1000)
Base: FreeBSD 15
Need help? Join our Discord community.