Immich Public Proxy

Share Immich photos and albums publicly without exposing the Immich instance itself.

Port	3000
Registry	ghcr.io/daemonless/immich-public-proxy
Source	https://github.com/alangrainger/immich-public-proxy
Website	https://github.com/alangrainger/immich-public-proxy

Version Tags

Tag	Description	Best For
latest	Upstream Binary. Built from official release.	Most users — recommended.

Prerequisites

Before deploying, ensure your host environment is ready. See the Quick Start Guide for host setup instructions.

Deployment

Podman Compose

services:
  immich-public-proxy:
    image: "ghcr.io/daemonless/immich-public-proxy:latest"
    container_name: immich-public-proxy
    environment:
      - IMMICH_URL=http://your-internal-immich-server:2283  # URL of your (private) Immich instance, e.g. http://immich-server:2283
      - PUBLIC_BASE_URL=https://your-proxy-url.com  # Public base URL this proxy is served from, no trailing slash (optional - derived from the request hostname if unset)
      - TZ=UTC  # Timezone for the container
      - IPP_PORT=  # Internal webserver port (default 3000)
    ports:
      - "3000:3000"
    # always (not unless-stopped) so FreeBSD's podman rc.d auto-starts it at boot
    restart: always

Save as compose.yaml, then run podman-compose up -d.

AppJail Director

.env:

# .env

DIRECTOR_PROJECT=immich-public-proxy
IMMICH_URL=http://your-internal-immich-server:2283
PUBLIC_BASE_URL=https://your-proxy-url.com
TZ=UTC
IPP_PORT=

appjail-director.yml:

# appjail-director.yml

options:
  - virtualnet: ':<random> default'
  - nat:
services:
  immich-public-proxy:
    name: immich_public_proxy
    options:
      - container: 'args:--pull'
      - expose: '3000:3000 proto:tcp'
    oci:
      user: root
      environment:
        - IMMICH_URL: !ENV '${IMMICH_URL}'
        - PUBLIC_BASE_URL: !ENV '${PUBLIC_BASE_URL}'
        - TZ: !ENV '${TZ}'
        - IPP_PORT: !ENV '${IPP_PORT}'

Makejail:

# Makejail

ARG tag=latest

OPTION container=boot
OPTION overwrite=force
OPTION from=ghcr.io/daemonless/immich-public-proxy:${tag}

Save the files above, then run appjail-director up.

Warning

Exposing ports in AppJail means that your service can be reached from remote hosts. If that is not your intention, do not expose the ports and communicate with the service using the jail's IPv4 address or hostname assigned by the virtual network.

To avoid exposing ports, just remove the expose option in your appjail-director.yml or from your command-line arguments.

Bastille

Warning

Bastille's OCI support is experimental. It requires buildah and shares the host network stack (inherit). Mount volumes with --volume HOST JAIL; without it, image-declared volumes are stored under ${bastille_volumesdir}/${jail}.

services:
  immich-public-proxy:
    name: immich-public-proxy
    image: "ghcr.io/daemonless/immich-public-proxy:latest"
    network:
      - mode: host
    environment:
      - IMMICH_URL=http://your-internal-immich-server:2283
      - PUBLIC_BASE_URL=https://your-proxy-url.com
      - TZ=UTC
      - IPP_PORT=

Save as bastille-compose.yml, then run bastille up.

Access at: http://localhost:3000

Parameters

Environment Variables

Variable	Default	Description
IMMICH_URL	http://your-internal-immich-server:2283	URL of your (private) Immich instance, e.g. http://immich-server:2283
PUBLIC_BASE_URL	https://your-proxy-url.com	Public base URL this proxy is served from, no trailing slash (optional - derived from the request hostname if unset)
TZ	UTC	Timezone for the container
IPP_PORT	``	Internal webserver port (default 3000)

Ports

Port	Protocol	Description
3000	TCP	Web UI

This image is part of the Immich Stack.

Architectures: amd64 User: bsd (UID/GID via PUID/PGID, defaults to 1000:1000) Base: FreeBSD 15

---

Need help? Join our Discord community.