Catalog / Collaboration & files

Immich

Self-hosted photo and video library with face recognition and smart search

CIS Level 1 hardened Ubuntu 24.04 LTS image by Lynxroute · unique credentials at first boot · CVE-scanned · SBOM and CIS report inside

AWS Marketplace3.3.5↗ Azure Marketplace3.2.4↗
Availability and pricing
CloudVersionSoftware priceLast build
AWS Marketplace
EC2 AMI · all commercial regions
3.3.5$0.05/hr
Recommended instance: t3.large · 5-day free trial
2026-10-23Listing ↗
Azure Marketplace
VM image · plan payg-gen2 · Gen2
3.2.4$0.028/vCPU/hr
Recommended VM: Standard_D2s_v3
2026-10-03Listing ↗

Software price only; cloud infrastructure is billed separately by the provider. Prices in USD.

Image facts
Base OSUbuntu 24.04 LTS
HardeningCIS Level 1, Ubuntu 24.04 LTS (tailored)
LicenseAGPL-3.0
UpstreamImmich
Machine-readableproduct.json · catalog.json
What is Immich

Immich is an open-source self-hosted photo and video backup platform - a private, no-trust-required alternative to Google Photos and iCloud. The stack runs as four docker containers: a Node and Python server that exposes the REST API and web UI on TCP 2283, a Python machine-learning container running CLIP for natural-language smart search and a face-detection model for grouping people, a PostgreSQL 14 database with the VectorChord and pgvecto.rs extensions for embedding-based queries, and a Redis-compatible cache (Valkey 9) for session and queue state. The mobile apps for iOS and Android perform background auto-upload of new photos and videos, full original-quality with EXIF and GPS metadata preserved. Operators get shared albums, public links, multi-user libraries with quotas, partner sharing, external libraries pointing at existing on-disk folders, RAW support, and HEIC and HEVC transcoding. AGPL-3.0 license, no vendor lock-in. The core differentiator vs. SaaS alternatives is sovereignty: photos, embeddings, face data, and the ML inference all stay on your own AWS account - none of it transits a third-party cloud.

What the Lynxroute image adds

Security hardening:

  • No pre-seeded admin account - on first visit the Immich web UI prompts you to register the first user, who becomes the admin. Immich locks admin sign-up automatically once the users table is non-empty, so subsequent attempts are rejected without operator action
  • Postgres password (32 chars, random) generated at first boot and written into /opt/immich/.env - never baked into the image
  • All four containers reachable only via the docker bridge - the host port 2283 is bound to 127.0.0.1 only, the only public-facing endpoint is Nginx on TCP 443
  • Nginx reverse proxy with self-signed TLS, HTTP-to-HTTPS redirect, WebSocket support for live sync, security headers, and a 50 GB client_max_body_size for RAW and 4K video uploads
  • All four container images pre-pulled at build time so first-launch is fast and not dependent on upstream registry availability
  • Docker daemon log rotation pre-configured to prevent json-file logs from filling the root volume
  • UFW firewall pre-configured - only TCP 22, 80, 443 are exposed
  • fail2ban, AppArmor
  • CVE scan - every image is scanned for vulnerabilities before release

OS hardening (CIS Level 1):

  • CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown
  • auditd, SSH hardening, kernel hardening, IMDSv2 enforced

Compliance artifacts:

  • SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
  • CIS Conformance Report at /etc/lynxroute/cis-report.html
  • CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md
Deploy

Launch in one command

Credentials are generated at first boot and written to /root/immich-credentials.txt.

# subscribe once on the AWS Marketplace listing, then:
aws ec2 run-instances \
  --image-id resolve:ssm:/aws/service/marketplace/prod-upweq7pqd3mok/latest \
  --instance-type t3.large --key-name my-key --security-group-ids sg-xxxxxxxx
# accept the plan terms once, then:
az vm image terms accept --publisher lynxroute --offer immich --plan payg-gen2
az vm create -g my-rg -n immich --size Standard_D2s_v3 \
  --image lynxroute:immich:payg-gen2:latest --admin-username azureuser --generate-ssh-keys
Release notes

Latest release

The most recent release with notes; the full release history is in product.json.

Immich 3.3.5

AWS · 2026-10-23
  • Immich updated 3.2.4 -> 3.3.5. AGPL-3.0 unchanged; no configuration or operator migration required
  • New: sharing with people, birthday memories and optional faster machine-learning models
  • Security: Node.js security patches and the certifi CA bundle updated to distrust the compromised eMudhra CA; bundled Valkey re-pinned to the upstream 3.3.5 image
  • Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base, picking up every operating-system security update published since the previous build