Immich Public Proxy

Description / name	Input element
Container Registry
Timezone
Immich Public Proxy Host Port

Share Immich photos and albums publicly without exposing the Immich instance itself.


Port	`3000`
Registry	`ghcr.io/daemonless/immich-public-proxy`
Daemonless	daemonless/immich-public-proxy
Source	daemonless/immich-public-proxy
Website	github.com/alangrainger/immich-public-proxy

Version Tags

Tag	Description	Best For
`latest`	Upstream Binary. Built from official release.	Most users. Matches Linux Docker behavior.

Root Privileges Required

Podman on FreeBSD currently requires root. All commands must be run as root (or via doas/sudo).

Before deploying, ensure your host environment is ready. See the Quick Start Guide for host setup instructions.

Deployment

Podman Compose AppJail Director Podman CLI AppJail Ansible

services:
  immich-public-proxy:
    image: "ghcr.io/daemonless/immich-public-proxy:latest"
    container_name: immich-public-proxy
    environment:
      - IMMICH_URL=http://your-internal-immich-server:2283  # URL of your (private) Immich instance, e.g. http://immich-server:2283
      - PUBLIC_BASE_URL=https://your-proxy-url.com  # Public base URL this proxy is served from, no trailing slash (optional - derived from the request hostname if unset)
      - TZ=UTC  # Timezone for the container
      - IPP_PORT=  # Internal webserver port (default 3000)
    ports:
      - "3000:3000"
    restart: unless-stopped

# .env

DIRECTOR_PROJECT=immich-public-proxy
IMMICH_URL=http://your-internal-immich-server:2283
PUBLIC_BASE_URL=https://your-proxy-url.com
TZ=UTC
IPP_PORT=

# appjail-director.yml

options:
  - virtualnet: ':<random> default'
  - nat:
services:
  immich-public-proxy:
    name: immich_public_proxy
    options:
      - container: 'boot args:--pull'
      - expose: '3000:3000 proto:tcp' \
    oci:
      user: root
      environment:
        - IMMICH_URL: !ENV '${IMMICH_URL}'
        - PUBLIC_BASE_URL: !ENV '${PUBLIC_BASE_URL}'
        - TZ: !ENV '${TZ}'
        - IPP_PORT: !ENV '${IPP_PORT}'

# Makejail

ARG tag=latest

OPTION overwrite=force
OPTION from=ghcr.io/daemonless/immich-public-proxy:${tag}

podman run -d --name immich-public-proxy \
  -p 3000:3000 \
  -e IMMICH_URL=http://your-internal-immich-server:2283 \
  -e PUBLIC_BASE_URL=https://your-proxy-url.com \
  -e TZ=UTC \
  -e IPP_PORT= \
  ghcr.io/daemonless/immich-public-proxy:latest

appjail oci run -Pd \
  -o overwrite=force \
  -o container="args:--pull" \
  -o virtualnet=":<random> default" \
  -o nat \
  -o expose="3000:3000 proto:tcp" \
  -e IMMICH_URL=http://your-internal-immich-server:2283 \
  -e PUBLIC_BASE_URL=https://your-proxy-url.com \
  -e TZ=UTC \
  -e IPP_PORT= \
  ghcr.io/daemonless/immich-public-proxy:latest immich-public-proxy

- name: Deploy immich-public-proxy
  containers.podman.podman_container:
    name: immich-public-proxy
    image: "ghcr.io/daemonless/immich-public-proxy:latest"
    state: started
    restart_policy: always
    env:
      IMMICH_URL: "http://your-internal-immich-server:2283"
      PUBLIC_BASE_URL: "https://your-proxy-url.com"
      TZ: "UTC"
      IPP_PORT: ""
    ports:
      - "3000:3000"

Access at: http://localhost:3000

Interactive Configuration

Parameters

Environment Variables

Variable	Default	Description
`IMMICH_URL`	`http://your-internal-immich-server:2283`	URL of your (private) Immich instance, e.g. http://immich-server:2283
`PUBLIC_BASE_URL`	`https://your-proxy-url.com`	Public base URL this proxy is served from, no trailing slash (optional - derived from the request hostname if unset)
`TZ`	`UTC`	Timezone for the container
`IPP_PORT`	``	Internal webserver port (default 3000)

Ports

Port	Protocol	Description
`3000`	TCP	Web UI

This image is part of the Immich Stack.

Implementation Details

Architectures: amd64
User: bsd (UID/GID set via PUID/PGID). Defaults to 1000:1000.
Base: Built on ghcr.io/daemonless/base (FreeBSD 15.1).

Need help? Join our Discord community.