Immich is a self-hosted photo and video manager with mobile uploads, albums, sharing and search. It can be an excellent choice when you want to run that service on your own hardware. Keeping the memories safe still requires a separate backup and a tested recovery process; uploading them to one home server is not sufficient protection.
What Immich does
The browser interface and mobile apps provide access to the library. Background jobs generate thumbnails, process media and support features such as Smart Search and facial recognition. Those jobs can consume resources during an initial import, so test a small collection before transferring years of photos.
Self-hosting gives you control over storage and access decisions. It does not automatically provide end-to-end encryption, encrypted disks, protected sharing links or immunity from a compromised account. The server must be able to read media to process it. Choose the access method and storage protection to match the people and devices using it.
See the official Immich site and its current documentation rather than assuming every older deployment recipe still matches the application.
Prepare hardware and storage
The current requirements list at least 6 GB RAM and two CPU cores, with 8 GB and four cores recommended. Check the supported architecture and use a maintained Docker Engine with the Compose plugin. The command is docker compose; the old docker-compose executable is not the supported path.
Keep the PostgreSQL database on suitable local storage that supports ownership and permissions. The project says network shares are unsupported for the database; preferably use local SSD storage. Media storage is a separate decision. If using a NAS mount for uploads, confirm it is mounted and writable before startup so a missing mount does not silently redirect your files to an unintended local directory.
Plan space for originals, generated thumbnails or videos, database data and independent backups. A photo count alone does not describe the capacity needed. Test a representative long video as well as small photos and watch the free-space trend.
Use a version-matched Compose stack
The official Compose workflow uses a complete release file and environment template. As a reproducible example, the verified stable release is v3.3.1. The following downloads its matching files into a new directory. Stop if a command fails, and do not overwrite an existing deployment's configuration with this example.
mkdir immich-app && cd immich-app && \
curl -fL https://github.com/immich-app/immich/releases/download/v3.3.1/docker-compose.yml -o docker-compose.yml && \
curl -fL https://github.com/immich-app/immich/releases/download/v3.3.1/example.env -o .envEdit the downloaded .env file, keeping the other template fields. Set the storage paths and timezone for your system, pin the version and replace the password placeholder with a strong random alphanumeric secret before starting:
UPLOAD_LOCATION=./library
DB_DATA_LOCATION=./postgres
TZ=Africa/Johannesburg
IMMICH_VERSION=v3.3.1
DB_PASSWORD=REPLACE_WITH_RANDOM_ALPHANUMERIC_PASSWORDThe release contains the server, machine-learning service, PostgreSQL database and a Valkey service still named redis in Compose. Keep the release's database image and extension configuration together rather than mixing a main-branch file or an arbitrary PostgreSQL image with another version.
For a private initial browser check, change the server's published port entry from 2283:2283 to 127.0.0.1:2283:2283. This limits that host binding to the server itself. A browser on another machine needs an SSH tunnel or a properly configured access path. Do not assume localhost on your laptop is the remote server.
docker compose config --quiet
docker compose up -d
docker compose psInspect errors before proceeding. These are deployment instructions, not a claim that this article has run your server. For mobile or remote access, configure a supported HTTPS proxy or private network path and test uploads and video playback using the proxy guidance.
Test the first media and account
Create the initial administrator, then use ordinary accounts for day-to-day users. Upload a small sample of photos and videos through the browser and phone. Check dates, orientation, original download, video playback and ownership. Make a test album and check its sharing access from a logged-out browser.
Select the intended phone albums and verify that new media actually reaches the server. Background upload depends on the mobile operating system's scheduling and settings; it is not an immediate continuous guarantee. Keep the phone's existing copies until uploads and recovery have been checked.
Smart Search and face grouping can help find media but can be wrong. Review results before naming people or deleting apparent duplicates. Model loading and initial jobs can take time; changing models or enabling hardware acceleration introduces separate configuration requirements.
Uploaded media versus external libraries
Uploaded media belongs to Immich's managed storage. Use the app to organise or delete it instead of moving internal files by hand. Storage templates can change its organisation; they are not a substitute for backing up the resulting files and database.
For an existing archive, an external library can scan a separately mounted directory. A read-only :ro mount prevents Immich writing to that mount, including deletion and XMP sidecar writes. It does not stop another program or storage administrator changing the originals. Test a small sample and keep an independent archive backup before scanning everything.
Back up both the database and media
Immich's automatic database dumps contain metadata, not photos or videos. The recovery guide requires the asset files as well. A dump stored on the same server as the library cannot recover a total loss of that storage.
Arrange an independent copy of the database backup, upload storage and any external-library originals. Keep the configuration and version details needed to recreate the paths. Use the documented backup order or pause changing media while taking a consistent backup.
Practise recovery on a separate suitable instance with the matching files and compatible version. Verify a few original downloads, albums, ownership and videos after restoration. Database restore replaces current database content; do not treat it as a harmless import into the live library. Check release notes and keep a recoverable copy before upgrades.
Immich versus Nextcloud
Nextcloud serves broader file and collaboration needs, while Immich focuses on a photo/video workflow. Nextcloud can also add media tagging and face recognition through Recognize; saying it lacks those capabilities is inaccurate.
Compare the actual apps and your representative library, rather than asserting one is always simpler or faster. Immich's value is strongest when its mobile and browsing workflow fits your family and you can maintain the storage, accounts and recovery plan. Test those essentials before replacing a working service or deleting its copies.
