{
 "slug": "immich",
 "name": "Immich",
 "tagline": "Self-hosted photo and video library with face recognition and smart search",
 "category": "collaboration",
 "use_cases": [
  "photo-backup",
  "media-library",
  "google-photos-alternative"
 ],
 "aliases": [],
 "status": "live",
 "upstream": {
  "vendor": "Immich",
  "url": "https://immich.app",
  "license": "AGPL-3.0",
  "license_url": "https://github.com/immich-app/immich/blob/main/LICENSE"
 },
 "image": {
  "os": "Ubuntu 24.04 LTS",
  "cis_level": 1,
  "ports": [
   80,
   443
  ],
  "artifacts": [
   "/etc/lynxroute/sbom.json",
   "/etc/lynxroute/cis-report.html",
   "/usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md"
  ]
 },
 "clouds": {
  "aws": {
   "status": "live",
   "version": "3.3.5",
   "last_build": "2026-10-23",
   "entity_id": "prod-upweq7pqd3mok",
   "ami_alias": "/aws/service/marketplace/prod-upweq7pqd3mok/latest",
   "listing_url": "https://aws.amazon.com/marketplace/pp/prodview-ta2kli7mudh6s",
   "recommended_instance_type": "t3.large",
   "price_usd_per_hour": 0.05,
   "free_trial_days": 5,
   "unit": "instance-hour"
  },
  "azure": {
   "status": "live",
   "version": "3.2.4",
   "last_build": "2026-10-03",
   "offer_id": "immich",
   "plan_id": "payg-gen2",
   "image_urn": "lynxroute:immich:payg-gen2:latest",
   "listing_url": "https://azuremarketplace.microsoft.com/en-us/marketplace/apps/lynxroute.immich?tab=Overview",
   "recommended_vm_size": "Standard_D2s_v3",
   "price_usd_per_vcpu_hour": 0.028,
   "unit": "vcpu-hour"
  },
  "alicloud": {
   "status": "not_offered"
  }
 },
 "urls": {
  "page": "https://lynxroute.com/products/immich/",
  "json": "https://lynxroute.com/products/immich/product.json"
 },
 "release_notes": [
  {
   "version": "3.3.5",
   "title": "Immich 3.3.5",
   "notes": "* Immich updated 3.2.4 -> 3.3.5. AGPL-3.0 unchanged; no configuration or operator migration required\n* New: sharing with people, birthday memories and optional faster machine-learning models\n* Security: Node.js security patches and the certifi CA bundle updated to distrust the compromised eMudhra CA; bundled Valkey re-pinned to the upstream 3.3.5 image\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base, picking up every operating-system security update published since the previous build\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-10-23"
   }
  },
  {
   "version": "3.2.4",
   "title": "Immich 3.2.4",
   "notes": "* Immich updated 3.2.2 -> 3.2.4, a patch release. AGPL-3.0 unchanged\n* Fixes the server memory growth reported on long-running instances, through an updated server base image\n* Fixes the mobile app's sync status page going blank when the counts query fails\n* Rebuilt on the current CIS Level 1 hardened Ubuntu 24.04 LTS base for the latest Ubuntu security updates\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-10-02",
    "azure": "2026-10-03"
   }
  },
  {
   "version": "3.2.2",
   "title": "Immich 3.2.2",
   "notes": "* Immich updated 3.2.1 -> 3.2.2, a patch release. AGPL-3.0 unchanged\n* Fixes face reassignment so it no longer picks up faces belonging to other users\n* Rebuilt on the current CIS Level 1 hardened Ubuntu 24.04 LTS base for the latest Ubuntu security updates\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-09-17",
    "azure": "2026-09-18"
   }
  },
  {
   "version": "3.2.1",
   "title": "Immich 3.2.1",
   "notes": "* Immich updated 3.2.0 -> 3.2.1, a patch release. AGPL-3.0 unchanged\n* Fixes database connection pool exhaustion during mobile sync and handling of sync client disconnects\n* Fixes partner-shared assets on the people page, merging two named people and face metadata extraction\n* The search modal keeps the selected search type and the untagged search option is back; the database is vacuumed after migrations and reindexed concurrently\n* Rebuilt on the current CIS Level 1 hardened Ubuntu 24.04 LTS base for the latest Ubuntu security updates\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-09-16"
   }
  },
  {
   "version": "3.2.0",
   "title": "Immich 3.2.0",
   "notes": "* Immich updated 3.1.0 -> 3.2.0, a minor release. AGPL-3.0 unchanged\n* Redesigned search on the web, backed by a new search API that combines several filters with AND and OR\n* Cluster groups let trusted users on the instance share facial recognition, so people you already have records of are identified in assets shared with you\n* New dedicated memories page with favourited memories kept indefinitely, tag renaming, and a timeline of the assets in the current map viewport\n* Workflows gain an asset-tagged trigger, a tag filter and an add-tags action; return-URL handling on the maintenance endpoint is hardened and the bundled Valkey cache image moves to 9.1.1\n* Rebuilt on the current CIS Level 1 hardened Ubuntu 24.04 LTS base for the latest Ubuntu security updates\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-09-11",
    "azure": "2026-09-13"
   }
  },
  {
   "version": "3.1.0",
   "title": "Immich v3.1.0",
   "notes": "* Re-release of Immich 3.1.0. The application version is unchanged; this build refreshes the underlying operating system image\n* Docker container logs stay size-capped (json-file 10m x 3) so they cannot fill the root volume\n* Certbot pre-installed - enable HTTPS with one command: sudo certbot --nginx -d yourdomain.com\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base, picking up every operating-system security update published since the previous build\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-09-04",
    "azure": "2026-08-19"
   }
  },
  {
   "version": "3.1.0",
   "title": "v3.1.0",
   "notes": "* Immich upgraded to 3.1.0 - quality-of-life improvements and bug fixes: the web uploader now holds a wakelock so the screen does not dim mid-upload (requires HTTPS), archiving assets can be undone straight from the success notification, assets can be filtered by server filepath in workflows, OIDC role-claim sync improvements, and sessions are invalidated on password reset\n* In-place upgrades now follow the vendor-standard flow: edit IMMICH_VERSION in /opt/immich/.env, then docker compose pull && up -d (see the UPGRADE block in /root/immich-credentials.txt)\n* Docker container logs are now size-capped (json-file 10m x 3) so they cannot fill the root volume\n* Certbot pre-installed - enable HTTPS with one command: sudo certbot --nginx -d yourdomain.com\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-09-04",
    "azure": "2026-08-19"
   }
  },
  {
   "version": "3.0.3",
   "title": "v3.0.3",
   "notes": "* Immich upgraded from 2.7.5 to 3.0.3\n* In-place upgrades now follow the vendor-standard flow: edit IMMICH_VERSION in /opt/immich/.env, then docker compose pull && up -d (see the UPGRADE block in /root/immich-credentials.txt)\n* Docker container logs are now size-capped (json-file 10m x 3) so they cannot fill the root volume\n* Certbot pre-installed - enable HTTPS with one command: sudo certbot --nginx -d yourdomain.com\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base\n",
   "source": "backfill-git",
   "live": {
    "aws": "2026-07-19",
    "azure": "2026-07-20"
   }
  },
  {
   "version": "2.7.5",
   "title": "v2.7.5",
   "notes": "* Hardening re-release of Immich 2.7.5 - upstream version unchanged\n* Certbot pre-installed - enable HTTPS with one command: sudo certbot --nginx -d yourdomain.com\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base\n",
   "source": "backfill-git",
   "live": {
    "aws": "2026-07-01",
    "azure": "2026-05-18"
   }
  }
 ],
 "release_history": [
  {
   "version": "3.3.5",
   "aws": "2026-10-23"
  },
  {
   "version": "3.2.4",
   "aws": "2026-10-02",
   "azure": "2026-10-03"
  },
  {
   "version": "3.2.2",
   "aws": "2026-09-17",
   "azure": "2026-09-18"
  },
  {
   "version": "3.2.1",
   "aws": "2026-09-16"
  },
  {
   "version": "3.2.0",
   "aws": "2026-09-11",
   "azure": "2026-09-13"
  },
  {
   "version": "3.1.0",
   "aws": "2026-09-04",
   "azure": "2026-08-19"
  },
  {
   "version": "3.0.3",
   "aws": "2026-07-19",
   "azure": "2026-07-20"
  },
  {
   "version": "2.7.5",
   "aws": "2026-07-01",
   "azure": "2026-05-18"
  }
 ],
 "deploy": {
  "aws_cli": "# subscribe once on the AWS Marketplace listing, then:\naws ec2 run-instances \\\n  --image-id resolve:ssm:/aws/service/marketplace/prod-upweq7pqd3mok/latest \\\n  --instance-type t3.large --key-name my-key --security-group-ids sg-xxxxxxxx",
  "azure_cli": "# accept the plan terms once, then:\naz vm image terms accept --publisher lynxroute --offer immich --plan payg-gen2\naz vm create -g my-rg -n immich --size Standard_D2s_v3 \\\n  --image lynxroute:immich:payg-gen2:latest --admin-username azureuser --generate-ssh-keys"
 },
 "description": {
  "what_is": "Immich is an open-source self-hosted photo and video backup platform - a private, no-trust-required alternative to Google Photos and iCloud. The stack runs as four docker containers: a Node and Python server that exposes the REST API and web UI on TCP 2283, a Python machine-learning container running CLIP for natural-language smart search and a face-detection model for grouping people, a PostgreSQL 14 database with the VectorChord and pgvecto.rs extensions for embedding-based queries, and a Redis-compatible cache (Valkey 9) for session and queue state. The mobile apps for iOS and Android perform background auto-upload of new photos and videos, full original-quality with EXIF and GPS metadata preserved. Operators get shared albums, public links, multi-user libraries with quotas, partner sharing, external libraries pointing at existing on-disk folders, RAW support, and HEIC and HEVC transcoding. AGPL-3.0 license, no vendor lock-in. The core differentiator vs. SaaS alternatives is sovereignty: photos, embeddings, face data, and the ML inference all stay on your own AWS account - none of it transits a third-party cloud.",
  "image_adds": "Security hardening:\n* No pre-seeded admin account - on first visit the Immich web UI prompts you to register the first user, who becomes the admin. Immich locks admin sign-up automatically once the users table is non-empty, so subsequent attempts are rejected without operator action\n* Postgres password (32 chars, random) generated at first boot and written into /opt/immich/.env - never baked into the image\n* All four containers reachable only via the docker bridge - the host port 2283 is bound to 127.0.0.1 only, the only public-facing endpoint is Nginx on TCP 443\n* Nginx reverse proxy with self-signed TLS, HTTP-to-HTTPS redirect, WebSocket support for live sync, security headers, and a 50 GB client_max_body_size for RAW and 4K video uploads\n* All four container images pre-pulled at build time so first-launch is fast and not dependent on upstream registry availability\n* Docker daemon log rotation pre-configured to prevent json-file logs from filling the root volume\n* UFW firewall pre-configured - only TCP 22, 80, 443 are exposed\n* fail2ban, AppArmor\n* CVE scan - every image is scanned for vulnerabilities before release\n\nOS hardening (CIS Level 1):\n* CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown\n* auditd, SSH hardening, kernel hardening, IMDSv2 enforced\n\nCompliance artifacts:\n* SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json\n* CIS Conformance Report at /etc/lynxroute/cis-report.html\n* CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md"
 },
 "generated_at": "2026-10-31T09:36:34Z"
}