Immich Public Proxy

Description / name	Input element
Container Registry
Timezone
Immich Public Proxy Host Port

Share Immich photos and albums publicly without exposing the Immich instance itself.


Port	`3000`
Registry	`ghcr.io/daemonless/immich-public-proxy`
Daemonless	daemonless/immich-public-proxy
Source	alangrainger/immich-public-proxy
Website	github.com/alangrainger/immich-public-proxy

Version Tags

Tag	Description	Best For
`latest`	Upstream Binary. Built from official release.	Most users — recommended.

Before deploying, ensure your host environment is ready. See the Quick Start Guide for host setup instructions, including the security model for host vs. container privileges.

Deployment

Podman AppJail

Compose CLI Ansible

services:
  immich-public-proxy:
    image: "ghcr.io/daemonless/immich-public-proxy:latest"
    container_name: immich-public-proxy
    environment:
      - IMMICH_URL=http://your-internal-immich-server:2283  # URL of your (private) Immich instance, e.g. http://immich-server:2283
      - PUBLIC_BASE_URL=https://your-proxy-url.com  # Public base URL this proxy is served from, no trailing slash (optional - derived from the request hostname if unset)
      - TZ=UTC  # Timezone for the container
      - IPP_PORT=  # Internal webserver port (default 3000)
    ports:
      - "3000:3000"
    # always (not unless-stopped) so FreeBSD's podman rc.d auto-starts it at boot
    restart: always

podman run -d --name immich-public-proxy \
  -p 3000:3000 \
  -e IMMICH_URL=http://your-internal-immich-server:2283 \
  -e PUBLIC_BASE_URL=https://your-proxy-url.com \
  -e TZ=UTC \
  -e IPP_PORT= \
  ghcr.io/daemonless/immich-public-proxy:latest

- name: Deploy immich-public-proxy
  containers.podman.podman_container:
    name: immich-public-proxy
    image: "ghcr.io/daemonless/immich-public-proxy:latest"
    state: started
    restart_policy: always
    env:
      IMMICH_URL: "http://your-internal-immich-server:2283"
      PUBLIC_BASE_URL: "https://your-proxy-url.com"
      TZ: "UTC"
      IPP_PORT: ""
    ports:
      - "3000:3000"

Director CLI

# .env

DIRECTOR_PROJECT=immich-public-proxy
IMMICH_URL=http://your-internal-immich-server:2283
PUBLIC_BASE_URL=https://your-proxy-url.com
TZ=UTC
IPP_PORT=

# appjail-director.yml

options:
  - virtualnet: ':<random> default'
  - nat:
services:
  immich-public-proxy:
    name: immich_public_proxy
    options:
      - container: 'boot args:--pull'
      - expose: '3000:3000 proto:tcp'
    oci:
      user: root
      environment:
        - IMMICH_URL: !ENV '${IMMICH_URL}'
        - PUBLIC_BASE_URL: !ENV '${PUBLIC_BASE_URL}'
        - TZ: !ENV '${TZ}'
        - IPP_PORT: !ENV '${IPP_PORT}'

# Makejail

ARG tag=latest

OPTION overwrite=force
OPTION from=ghcr.io/daemonless/immich-public-proxy:${tag}

appjail oci run -Pd \
  -o overwrite=force \
  -o container="args:--pull" \
  -o virtualnet=":<random> default" \
  -o nat \
  -o expose="3000:3000 proto:tcp" \
  -e IMMICH_URL=http://your-internal-immich-server:2283 \
  -e PUBLIC_BASE_URL=https://your-proxy-url.com \
  -e TZ=UTC \
  -e IPP_PORT= \
  ghcr.io/daemonless/immich-public-proxy:latest immich-public-proxy

Access at: http://localhost:3000

Interactive Configuration

Parameters

Environment Variables

Variable	Default	Description
`IMMICH_URL`	`http://your-internal-immich-server:2283`	URL of your (private) Immich instance, e.g. http://immich-server:2283
`PUBLIC_BASE_URL`	`https://your-proxy-url.com`	Public base URL this proxy is served from, no trailing slash (optional - derived from the request hostname if unset)
`TZ`	`UTC`	Timezone for the container
`IPP_PORT`	``	Internal webserver port (default 3000)

Ports

Port	Protocol	Description
`3000`	TCP	Web UI

This image is part of the Immich Stack.

Implementation Details

Architectures: amd64
User: bsd (UID/GID set via PUID/PGID). Defaults to 1000:1000.
Base: Built on ghcr.io/daemonless/base (FreeBSD 15.1).

Need help? Join our Discord community.