Immich

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2s (2 vCPU / 4 GiB RAM) comfortably runs the core stack (server, database and cache) with machine learning off. To use Immich's machine-learning features (smart search and face recognition), launch on a larger size such as Standard_B4ms (see Step 10).

Configure the network security group (NSG) to allow inbound 22/tcp from your management network and 80/tcp from the clients that will use Immich. The app serves plain HTTP, so for production put it behind your own domain and TLS.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Immich by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22). You add port 80 after deployment.

Select Review + create, then Create.

Step 2 - Deploy from the Azure CLI

Run the following commands to accept the Marketplace terms, create the VM and open port 80:

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:immich-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name immich \
  --image sac1647283583153:immich-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name immich --port 80 --priority 1010

Step 3 - Connect to your VM

Connect to the VM over SSH with the administrator account you created:

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the stack is running

Immich runs as a Docker Compose stack managed by a single systemd unit. On first boot, the stack rotates its database password, re-initializes on a clean database, seeds the per-VM admin and starts. The multi-container stack can take a minute or two to become fully healthy after the VM is created.

Check the service state:

systemctl is-active immich.service

The command reports active. List the running containers with:

sudo docker compose -f /var/lib/immich/docker-compose.yml ps

Because the whole stack is one systemd unit, use sudo systemctl status immich and sudo systemctl restart immich to control every container together.

Step 5 - Retrieve your per-VM admin credentials

Immich generates a unique admin password on the first boot of your VM and writes it to a root-only file. Confirm that the file exists. Its mode is 0600, so only root can read it:

sudo ls -l /root/immich-credentials.txt

Read the file to get your credentials:

sudo cat /root/immich-credentials.txt

The file contains immich.url (the address to browse to), immich.admin.email and IMMICH_ADMIN_PASSWORD (for the web interface). Store them somewhere safe. The first-boot service that seeded them is a one-shot unit. Confirm that it ran:

systemctl is-active immich-firstboot.service

Step 6 - Confirm the endpoints are healthy

Check that the Immich interface answers on port 80 through the nginx reverse proxy:

curl -s -o /dev/null -w 'UI (nginx :80) -> HTTP %{http_code}\n' http://localhost/

The command returns HTTP 200. Next, query the Immich server's health endpoint, which answers pong:

curl -s http://localhost/api/server/ping

List the published ports. PostgreSQL (5432) and Redis (6379) are deliberately absent from the list, because they stay on the internal Docker network:

sudo ss -tlnH | awk '{print $4}' | sort -u

Step 7 - Confirm the pinned release

The images are pinned to Immich v3.1.0, with the database and cache images digest-pinned, so the appliance never silently upgrades. List the images to confirm:

sudo docker compose -f /var/lib/immich/docker-compose.yml images

Step 8 - Sign in to the web UI

In a browser, go to http://<vm-public-ip>/. Immich opens on its login page.

Sign in with the immich.admin.email and IMMICH_ADMIN_PASSWORD from Step 5. The admin was already seeded on first boot, so there is no registration step for a stranger to hijack. You land straight on the login form.

Step 9 - Upload your first photos

Select Upload (top right) and choose some photos or videos. Alternatively, install an Immich mobile app and point it at http://<vm-public-ip>/ to back up your camera roll automatically. Uploaded media appears on the timeline immediately, grouped by date.

To group photos into albums, open the Albums section, create an album and add assets to it. You can share an album with a link or with another user.

Step 10 - Manage users and enable machine learning (optional)

As the admin, manage users and server settings from Administration. The image ships with exactly one account, your per-VM admin. Immich creates further users only when you invite them, so there is no open sign-up.

Machine learning (smart search and face recognition) ships disabled so the appliance fits a small VM. To enable it, launch the image on a larger VM (Standard_B4ms or bigger). Then bring up the machine-learning container:

cd /var/lib/immich
sudo docker compose --profile ml up -d

In the web interface, go to Administration -> Settings -> Machine Learning Settings and enable the feature. Immich then begins generating smart-search embeddings and detecting faces in your library.

Support

SecureAnyCloud images come with 24/7 support. For questions about this Immich image or help with your deployment, contact SecureAnyCloud support.

Deploy on Azure

Launch Immich on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com