[Feature]: Support native deployments (without docker, includes example)

[oddlama]

Feature detail

Thanks for the great app! One thing that I'm dearly missing is the ability to deploy this on bare-metal, without relying on docker. The problem is that in certain situations, docker might not be a viable option to deploy a project. I for example am using an extremely strict nftables firewall, for which docker simply has no compatibility (and docker will likely still take some years to catch up). Furthermore, I deploy each application in its own KVM virtual machine with libvirt, so docker would just be an unnecessary overhead for me.

I have already managed to get immich running without docker just fine, it would just be missing a tiny bit of packaging to make the process more accessible and repeatable. I've attached my scripts to build and deploy immich below in case you (or any other people stumbling over this) are interested.

Installing on bare-metal

1. Create user for immich (/var/lib/immich)
2. Create environment file /var/lib/immich/env (adapt from upstream provided .env.example)
3. Build app and create links to upload folder with script runuser -u immich -- ./build.sh
4. Map container aliases to localhost in /etc/hosts like this: 127.0.0.1 localhost immich-server immich-microservices immich-machine-learning immich-web
5. Create fstab entry to bind mount /the/backup/folder/you/want to /var/lib/immich/upload
6. Start redis, postgresql and provided systemd services

The need to map the upload folder in several app directories is a little clunky right now, just like having to use /etc/hosts because hostnames are hardcoded. But the rest is working like a charm without docker.

You might need to change the systemd services a little to fit your system if e.g. your postgresql service is not called postgresql-14.service, or when it is running on another system. I've also used systemd to do sandboxing for the services, so they will not be able to access other directories if you need that for some reason.

Buildscript build.sh

This script is adapted from the Dockerfiles I found in this repo.

#!/bin/bash

IMMICH_TAG=v1.29.4_44-dev

set -uo pipefail
function die() { echo "error: $*" >&2; exit 1; }
function try() { "$@" || die "Command failed: $*"; }

TMP="$(mktemp --tmpdir=/var/tmp -d)" || die "Could not create tmpdir"
trap 'rm -rf -- "$TMP"' EXIT

try cd "$TMP"
try git clone https://github.com/immich-app/immich
try cd "$TMP"/immich
try git checkout "$IMMICH_TAG"

# Build server
try cd "$TMP"/immich/server
try npm ci
try npm run build
try npm prune --production
try mkdir app
try cp -a package.json package-lock.json node_modules dist app

# Build web frontend
try cd "$TMP"/immich/web
try npm ci
try npm run build
# TODO: why is the whole folder used here? Can we strip something from here? What about npm prune --production?

# Build machine-learning
try cd "$TMP"/immich/machine-learning
try npm ci
try npm rebuild @tensorflow/tfjs-node --build-from-source
try npm run build
try npm prune --production
try mkdir app
try cp -a package.json package-lock.json node_modules dist app

# Copy only relevant files to new directory
try cd "$TMP"/
try mkdir app
try mv "$TMP"/immich/server/app app/server
try mv "$TMP"/immich/web app/web
try mv "$TMP"/immich/machine-learning/app app/machine-learning

# Install new files (deleting old deployment)
[[ -e /var/lib/immich/app ]] && try rm -rf /var/lib/immich/app
try cp -r app /var/lib/immich/app

# Ensure the upload folder is available
mkdir -p /var/lib/immich/upload
ln -s /var/lib/immich/upload /var/lib/immich/app/server/upload
ln -s /var/lib/immich/upload /var/lib/immich/app/machine-learning/upload

Systemd service immich-server.service

[Unit]
Description=immich server
Documentation=https://github.com/immich-app/immich
Requires=redis-immich.service
Requires=postgresql-14.service
After=network.target
Wants=network-online.target
After=network-online.target

[Service]
User=immich
Group=immich
Type=simple
Restart=on-failure

EnvironmentFile=/var/lib/immich/env
Environment=NODE_ENV=production
SyslogIdentifier=immich-server
ExecStart=node dist/apps/immich/apps/immich/src/main

PrivateDevices=true
ProtectHome=true
ProtectSystem=strict
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectControlGroups=yes

RestrictNamespaces=yes

SystemCallArchitectures=native
AmbientCapabilities=
CapabilityBoundingSet=
NoNewPrivileges=yes

WorkingDirectory=/var/lib/immich/app/server
ReadWritePaths=/tmp /var/tmp /var/lib/immich/upload

[Install]
WantedBy=multi-user.target

Systemd service immich-microservices.service

[Unit]
Description=immich microservices
Documentation=https://github.com/immich-app/immich
Requires=redis-immich.service
Requires=postgresql-14.service
After=network.target
Wants=network-online.target
After=network-online.target

[Service]
User=immich
Group=immich
Type=simple
Restart=on-failure

EnvironmentFile=/var/lib/immich/env
Environment=NODE_ENV=production
SyslogIdentifier=immich-microservices
ExecStart=node dist/apps/microservices/apps/microservices/src/main

PrivateDevices=true
ProtectHome=true
ProtectSystem=strict
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectControlGroups=yes

RestrictNamespaces=yes

SystemCallArchitectures=native
AmbientCapabilities=
CapabilityBoundingSet=
NoNewPrivileges=yes

WorkingDirectory=/var/lib/immich/app/server
ReadWritePaths=/tmp /var/tmp /var/lib/immich/upload

[Install]
WantedBy=multi-user.target

Systemd service immich-machine-learning.service

[Unit]
Description=immich machine learning
Documentation=https://github.com/immich-app/immich
Requires=postgresql-14.service
After=network.target
Wants=network-online.target
After=network-online.target

[Service]
User=immich
Group=immich
Type=simple
Restart=on-failure

EnvironmentFile=/var/lib/immich/env
Environment=NODE_ENV=production
SyslogIdentifier=immich-machine-learning
ExecStart=node dist/main.js

PrivateDevices=true
ProtectHome=true
ProtectSystem=strict
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectControlGroups=yes

RestrictNamespaces=yes

SystemCallArchitectures=native
AmbientCapabilities=
CapabilityBoundingSet=
NoNewPrivileges=yes

WorkingDirectory=/var/lib/immich/app/machine-learning
ReadWritePaths=/tmp /var/tmp /var/lib/immich/upload

[Install]
WantedBy=multi-user.target

Systemd service immich-web.service

[Unit]
Description=immich web
Documentation=https://github.com/immich-app/immich
After=network.target
Wants=network-online.target
After=network-online.target

[Service]
User=immich
Group=immich
Type=simple
Restart=on-failure

EnvironmentFile=/var/lib/immich/env
Environment=NODE_ENV=production
SyslogIdentifier=immich-web
ExecStart=node build/index.js

PrivateDevices=true
ProtectHome=true
ProtectSystem=strict
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectControlGroups=yes

RestrictNamespaces=yes

SystemCallArchitectures=native
AmbientCapabilities=
CapabilityBoundingSet=
NoNewPrivileges=yes

WorkingDirectory=/var/lib/immich/app/web
ReadWritePaths=/tmp /var/tmp

[Install]
WantedBy=multi-user.target

---

P.S.: Is it intended that compiling the most recent release with npm reports 10+ high and 3 critical security issues? Not sure what to do about that as a user.

Platform

Server

[StillLoading]

Thank you for this. Really appreciate the work you put into sorting this out.

For anyone wanting to deploy on OpenSUSE Tumbleweed/MicroOS here are some pointers.

Dependencies

For building

make gcc gcc-c++ npm18 nodejs18 nodejs18-devel nodejs-common

For hosting

nginx redis postgresql-server

SELinux

Allow local nginx proxy to connect to local services via port

setsebool -P httpd_can_network_connect 1

Nginx

Grab the config from this repository and modify to your needs.

[huangfengjing]

Nice work.
Can anybody compose a Batch-Script/PowerShell script like this to help deploying immich on Windows?

[jumbi77]

Thanks a lot.
One question: Is this Requires=redis-immich.service correct in systemd.services? My system cant find those and i had to change them Requires=redis-server.service

[StillLoading]

@jumbi77 I think @oddlama did a good job at pointing that out in his post.

You might need to change the systemd services a little to fit your system if e.g. your postgresql service is not called postgresql-14.service, or when it is running on another system...

[hydazz]

(off topic)
using this installing on bare-metal method, I am creating a (hopefully) functioning single immich container for me to use on unraid (docker-compose is really messy). main issue is that the server expects hostnames immich-server immich-microservices immich-machine-learning immich-web and the hosts file cant be modified on docker so I end up with

Error: getaddrinfo ENOTFOUND immich-server

https://github.com/hydazz/docker-immich
#appsshouldbeasignecontainerwhereapplicable

edit: all seems to be working in latest commit...

[alextran1502]

(off topic) using this installing on bare-metal method, I am creating a (hopefully) functioning single immich container for me to use on unraid (docker-compose is really messy). main issue is that the server expects hostnames immich-server immich-microservices immich-machine-learning immich-web and the hosts file cant be modified on docker so I end up with

Error: getaddrinfo ENOTFOUND immich-server

https://github.com/hydazz/docker-immich #appsshouldbeasignecontainerwhereapplicable

edit: all seems to be working in latest commit...

Thank you for the contribution.

I have a thought about your hashtag #appsshouldbeasignecontainerwhereapplicable

Let's say you want to limit the CPU of machine-learning and microservices containers which handle the intensive background tasks, so that your core server can still handle I/O operations effectively and efficiently while there are people performing backing up. Can you do that with the single container image?

[hydazz]

Let's say you want to limit the CPU of machine-learning and microservices containers which handle the intensive background tasks, so that your core server can still handle I/O operations effectively and efficiently while there are people performing backing up. Can you do that with the single container image?

Yes, that's not really possible on a single container - there are indeed use cases for having the containers separated on lower-powered hardware. Most self-hosted image services have single containers which makes deployment much easier on specific OSes (ie Unraid), where most users won't even think about limiting the CPU of a container.

[bt90]

You could try to start the container with the sys_nice capability and change the process priorities inside the container to accomplish that.

https://docs.docker.com/config/containers/resource_constraints/#configure-individual-containers

Pair that with e.g dumb-init:

https://github.com/Yelp/dumb-init#session-behavior

[hydazz]

You could try to start the container with the sys_nice capability and change the process priorities inside the container to accomplish that.

https://docs.docker.com/config/containers/resource_constraints/#configure-individual-containers

Pair that with e.g dumb-init:

https://github.com/Yelp/dumb-init#session-behavior

there should be a way to achieve this with s6 and s6-overlay

Why does the machine-learning module spawn 40+ processes that use up over 1GB of ram at idle? is this necessary? is it possible to have the machine-learning run on-demand rather than all the time?

[denis-ali]

Any chance on updating this to v1.50.x?

Seems since 1.48 some changes were introduced, like the machine learning module in python, which no longer makes the script that much valid.

[derzahla]

awesome. thanks for this. Im trying to put together immich in a freebsd jail on truenas so this will be helpful

[jeroenh]

Happy to help with this, I'd like to run this on my FreeBSD server as well.

[spusuf]

Same with me, did you get it working on BSD?

[arcepi]

I have it working in a FreeBSD 13.1 jail. I followed more or less the Dockerfiles to adapt the process and also created rc.d scripts.

The only thing I didn't get working is the machine-learning part as it requires pytorch2, which doesn't have a port for FreeBSD yet.

I want something more automated so I began today to try to make ports for immich_web, immich_server and immich_microservices, but it is my first time writing a FreeBSD port so progress is slow.
I already have a port for immich_web which I think installs the web part correctly in /usr/local/www/immich/web and its rc.d file.

The main problem I had with my "manual" deployment is that sometimes the applications don't use the values set in the environment file (the most important that doesn't work is the path to the stored files). But it is probably my fault.

If I manage to have the ports working I'll put a comment here and I will try sending them to FreeBSD ports (although I don't know how involved that process will be).

[spusuf]

I'd definitely be keen to replicate that. Maybe make a GitHub page for all the files, install script (any commands you used in the console), and changes needed (such as environment variables). I can contribute on there.

[arcepi]

Hello! I can't send you the steps I did because I'm on holidays and I have them on my desktop computer.

Anyway, I have ready the ports for the web, server and microservices. With that I've been running Immich (although I know it is limited).
0001-Add-changes-for-new-ports-for-Immich.patch

I attach a git diff to the FreeBSD ports tree. Please, test the two ports. If I did everything right it should be as simple as doing make && make install and then editing environment files in /usr/local/etc/immich to fit your environment and configuring nginx. For that I also install a template in /usr/local/etc/nginx.

Hope it works.

[tgutzler]

This is going to be a lengthy discussion, I think...
Following the OP's efforts, I'm attempting to run immich on a proxmox container running debian bookworm. However, things have changed and the build script no longer runs, so I'm working my way through the Dockerfiles myself.
I checked out master on my build server, built the server part, copied the previously mentioned files across to the container, installed a bunch of dependencies and am now trying to get the microservices up. However, I'm getting an error from the redis client ioredis:

node dist/main microservices
[Nest] 10643 - 08/20/2023, 10:42:22 AM LOG [NestFactory] Starting Nest application...
[Nest] 10643 - 08/20/2023, 10:42:22 AM LOG [InstanceLoader] TypeOrmModule dependencies initialized +60ms
[Nest] 10643 - 08/20/2023, 10:42:22 AM LOG [InstanceLoader] BullModule dependencies initialized +0ms
[Nest] 10643 - 08/20/2023, 10:42:22 AM LOG [InstanceLoader] ConfigHostModule dependencies initialized +2ms
[Nest] 10643 - 08/20/2023, 10:42:22 AM LOG [InstanceLoader] DiscoveryModule dependencies initialized +0ms
[Nest] 10643 - 08/20/2023, 10:42:22 AM LOG [InstanceLoader] ConfigModule dependencies initialized +9ms
[Nest] 10643 - 08/20/2023, 10:42:22 AM LOG [InstanceLoader] BullModule dependencies initialized +0ms
[Nest] 10643 - 08/20/2023, 10:42:22 AM LOG [InstanceLoader] BullModule dependencies initialized +0ms
[Nest] 10643 - 08/20/2023, 10:42:23 AM LOG [InstanceLoader] TypeOrmCoreModule dependencies initialized +211ms
[Nest] 10643 - 08/20/2023, 10:42:23 AM LOG [InstanceLoader] TypeOrmModule dependencies initialized +1ms
[Nest] 10643 - 08/20/2023, 10:42:23 AM LOG [InstanceLoader] TypeOrmModule dependencies initialized +0ms
[Nest] 10643 - 08/20/2023, 10:42:23 AM LOG [InstanceLoader] InfraModule dependencies initialized +9ms
[Nest] 10643 - 08/20/2023, 10:42:23 AM LOG [InstanceLoader] DomainModule dependencies initialized +5ms
[Nest] 10643 - 08/20/2023, 10:42:23 AM LOG [InstanceLoader] MicroservicesModule dependencies initialized +0ms
[Nest] 10643 - 08/20/2023, 10:42:23 AM LOG [MetadataExtractionProcessor] Reverse geocoding is enabled
[Nest] 10643 - 08/20/2023, 10:42:23 AM LOG [MetadataExtractionProcessor] Initializing Reverse Geocoding
Error: connect ETIMEDOUT
at Socket. (/var/lib/immich/app/server/node_modules/ioredis/built/Redis.js:170:41)
at Object.onceWrapper (node:events:627:28)
at Socket.emit (node:events:513:28)
at Socket._onTimeout (node:net:569:8)
at listOnTimeout (node:internal/timers:564:17)
at process.processTimers (node:internal/timers:507:7) {
errorno: 'ETIMEDOUT',
code: 'ETIMEDOUT',
syscall: 'connect'
}

My redis appears to be running:

systemctl status redis
● redis-server.service - Advanced key-value store
Loaded: loaded (/lib/systemd/system/redis-server.service; enabled; preset: enabled)
Active: active (running) since Sat 2023-08-19 21:05:31 AWST; 13h ago
Docs: http://redis.io/documentation,
man:redis-server(1)
Main PID: 5464 (redis-server)
Status: "Ready to accept connections"
Tasks: 5 (limit: 9304)
Memory: 5.2M
CPU: 1min 2.470s
CGroup: /system.slice/redis-server.service
└─5464 "/usr/bin/redis-server 127.0.0.1:6379"
Aug 19 21:05:31 immich systemd[1]: Starting redis-server.service - Advanced key-value store...
Aug 19 21:05:31 immich systemd[1]: Started redis-server.service - Advanced key-value store.

I have added the following entry to my /etc/hosts file:
127.0.0.1 immich_redis immich_postgres typesense immich-server immich-microservices immich-machine-learning immich-web

What am I missing?

[timdonovanuk]

Please add native (bare metal) install support. :/

[Aerodin]

You may want to take a look at this thread:
tteck/Proxmox#1096

A Debian install path on bare metal would allow someone like TTeck to create a simple install script to install it on Proxmox or an LXC container which would lead to more widespread adoption. Perhaps a collaboration between the Immich team and TTek can lead to him creating a simple install script for Proxmox/LXC which could be leveraged by other platforms like Unraid etc. that are seeking to host this in a non-Docker native environment as well. Then everyone benefits from a simplified installation process.

I am watching this software with fascination and want to try it out, however, the comments above about issues installing it bare metal copying the docker files scares me away.

[timdonovanuk]

Yep! Huge +1 to this comment. I'm a huge fan of docker, and started my self hosting journey using it heavily. I've since moved over to LXC's for everything, and indeed a 80% of the ~ 30 LXC's I run come from tteck. I was disappointed to see there is no immich lxc on the tteck site, so was looking into why, and that is how I ended up here asking for bare metal install support. Completely agree that a tteck script would really help drive adoption of immich.

[anubis-genix]

This would be an enormous enrichment for the non-technical users!

[tgutzler]

Sign me up for beta-testing LXCs!

[SR-Lut3t1um]

I guess it would be best if someone would contribute build scripts, to build the packages in apt/rpm. Than a simple repo could be provided making installing on bare metal a lot simpler. Postgres, redis etc. can be expected to be installed and configured manually, however a little work for documentation would be necessary. I don't know what the current state of the art of package building looks like, however something like OBS might help here, (vaultwarden uses this approach too).

[dpantel]

Slightly off-topic:

1. I stumbled on this project the other day. It’s an unofficial Snap repackaging. It’s not going to help any of us wanting to run “bare-metal”, but might be a good option for Ubuntu users instead of using Docker.

2. I’m successfully running Docker/Immich in an unprivileged LXC container on Proxmox. The only concession I had to make was a raw ext4 virtual disk for the Docker directory. That’s only necessary because my backing FS is ZFS. And on that front, according to recent commits, ZFS might now/soon support unprivileged container overlay FS, which might allow running Docker in LXC on ZFS with no issues.

[smiba]

Not having native deployments is incredibly unfortunate, I wish I could just install this inside an LXC container without docker

[micash545]

I found a method but I'm still working on it. I will share soon

[arter97]

Seems like Immich changed a quite since the last time OP was updated.

I took the liberty of creating some scripts to natively install Immich v1.97.0.

https://github.com/arter97/immich-native

Leaving it here so that other people can find it useful.

[arcepi]

Very useful! I have almost ready port files for FreeBSD and the only piece missing was pgvecto.rs, but I see that using pgvector is also compatible!!!

Do you know if there is any limitation when using pgvector instead of pgvecto.rs?

[mmomjian]

You can read more about pgvector here. Currently, the answer is "some features may not work quite as well with pgvector". The devs primarily operate with vecto.rs so I doubt there is much testing done with pgvector.

[arcepi]

Thanks @mmomjian, I had completely missed that part about pgvector compatibility.

[daftaupe]

Very useful! I have almost ready port files for FreeBSD and the only piece missing was pgvecto.rs, but I see that using pgvector is also compatible!!!

@arcepi Very interesting, I have immich running on FreeBSD. I can give your port a try/test whenever you feel it's ready.

[PedanticAvenger]

I'm adding a vote to the "Please provide native deployment support". From my perspective it can be leveraged into a docker container build workflow and allow LXC container support (or other bare-metal installs) without increasing support/deployment load meaningfully.