Sure, I set it up in nixos though this is the short form of that:
spoiler
Install Podman and passt + slirp4netns for networking
Setup subuid and subgid usermod --add-subuids 100000-165535 --add-subgids 100000-165535 johndoe
I’m using quadlet’s so we need to create those:
$HOME/.config/containers/systemd/immich-database.container
[Unit]Description=Immich Database
Requires=immich-redis.service immich-network.service
[Container]AutoUpdate=registry
EnvironmentFile=${immich-config}# add your environment variables file hereImage=registry.hub.docker.com/tensorchord/pgvecto-rs:pg14-v0.2.0@sha256:90724186f0a3517cf6914295b5ab410db9ce23190a2d9d0b9dd6463e3fa298f0 # hash from the official docker-compose, has to be updated from time to timeLabel=registry
Pull=newer # update to newest image, though this image is specified by hash and will never update to another version unless the hash is changedNetwork=immich.network # attach to the podman networkUserNS=keep-id:uid=999,gid=999# This makes uid 999 and gid 999 map to the user running the service, this is so that you can access the files in the volume without any special handling otherwise root would map to your uid and the uid 999 would map to some very high uid that you can't access without podman - This modifies the image at runtime and may make the systemd service timeout, maybe increase the timeout on low-powered machines Volume=/srv/services/immich/database:/var/lib/postgresql/data # Database persistanceVolume=/etc/localtime:/etc/localtime:ro # timezone infoExec=postgres -c shared_preload_libraries=vectors.so -c 'search_path="$user", public, vectors' -c logging_collector=on -c max_wal_size=2GB -c shared_buffers=512MB -c wal_compression=on# also part of official docker-compose.....last time i checked anyways[Service]Restart=always
[Unit]Description=Immich Server
Requires=immich-redis.service immich-database.service immich-network.service immich-ml.service
[Container]AutoUpdate=registry
EnvironmentFile=${immich-config}#same config as aboveImage=ghcr.io/immich-app/immich-server:release
Label=registry
Pull=newer # auto update on startupNetwork=immich.network
PublishPort=127.0.0.1:2283:2283Volume=/srv/services/immich/upload:/usr/src/app/upload # i think you can put images here to import, though i never used itVolume=/etc/localtime:/etc/localtime:ro # timezone infoVolume=/srv/services/immich/library:/imageLibrary # here the images are stored once imported[Service]Restart=always
[Install]WantedBy=multi-user.target default.target
Can confirm, works without problems in rootless podman.
Can you give me some pointers? I’m still new to docker and podman; hoping to get this going without too much learning curve to start with!
Sure, I set it up in nixos though this is the short form of that:
spoiler
usermod --add-subuids 100000-165535 --add-subgids 100000-165535 johndoe[Unit] Description=Immich Database Requires=immich-redis.service immich-network.service [Container] AutoUpdate=registry EnvironmentFile=${immich-config} # add your environment variables file here Image=registry.hub.docker.com/tensorchord/pgvecto-rs:pg14-v0.2.0@sha256:90724186f0a3517cf6914295b5ab410db9ce23190a2d9d0b9dd6463e3fa298f0 # hash from the official docker-compose, has to be updated from time to time Label=registry Pull=newer # update to newest image, though this image is specified by hash and will never update to another version unless the hash is changed Network=immich.network # attach to the podman network UserNS=keep-id:uid=999,gid=999 # This makes uid 999 and gid 999 map to the user running the service, this is so that you can access the files in the volume without any special handling otherwise root would map to your uid and the uid 999 would map to some very high uid that you can't access without podman - This modifies the image at runtime and may make the systemd service timeout, maybe increase the timeout on low-powered machines Volume=/srv/services/immich/database:/var/lib/postgresql/data # Database persistance Volume=/etc/localtime:/etc/localtime:ro # timezone info Exec=postgres -c shared_preload_libraries=vectors.so -c 'search_path="$user", public, vectors' -c logging_collector=on -c max_wal_size=2GB -c shared_buffers=512MB -c wal_compression=on # also part of official docker-compose.....last time i checked anyways [Service] Restart=always$HOME/.config/containers/systemd/immich-ml.container
[Unit] Description=Immich Machine Learning Requires=immich-redis.service immich-database.service immich-network.service [Container] AutoUpdate=registry EnvironmentFile=${immich-config} #same config as above Image=ghcr.io/immich-app/immich-machine-learning:release Label=registry Pull=newer # auto update on startup Network=immich.network Volume=/srv/services/immich/ml-cache:/cache # machine learning cache Volume=/etc/localtime:/etc/localtime:ro [Service] Restart=always$HOME/.config/containers/systemd/immich.network
[Unit] Description=Immich network [Network] DNS=8.8.8.8 Label=app=immich $HOME/.config/containers/systemd/immich-redis.container [Unit] Description=Immich Redis Requires=immich-network.service [Container] AutoUpdate=registry Image=registry.hub.docker.com/library/redis:6.2-alpine@sha256:eaba718fecd1196d88533de7ba49bf903ad33664a92debb24660a922ecd9cac8 # should probably change this to valkey.... Label=registry Pull=newer # auto update on startup Network=immich.network Timezone=Europe/Berlin [Service] Restart=always$HOME/.config/containers/systemd/immich-server.container
[Unit] Description=Immich Server Requires=immich-redis.service immich-database.service immich-network.service immich-ml.service [Container] AutoUpdate=registry EnvironmentFile=${immich-config} #same config as above Image=ghcr.io/immich-app/immich-server:release Label=registry Pull=newer # auto update on startup Network=immich.network PublishPort=127.0.0.1:2283:2283 Volume=/srv/services/immich/upload:/usr/src/app/upload # i think you can put images here to import, though i never used it Volume=/etc/localtime:/etc/localtime:ro # timezone info Volume=/srv/services/immich/library:/imageLibrary # here the images are stored once imported [Service] Restart=always [Install] WantedBy=multi-user.target default.targetloginctl enable-linger $USER