Deployment guide

PhotoPrism

Overview

PhotoPrism is an AI-powered, self-hosted application for browsing, organising and sharing your photos and videos. It indexes your collection into a fast, searchable library and automatically tags what is in each picture. It also groups faces, places and moments, all on infrastructure you control rather than a third-party photo service.

The SecureAnyCloud image installs PhotoPrism 260601 as the official container paired with MariaDB and runs it behind nginx as a systemd service. It indexes a small demo library on first boot, so your photo library is online and ready to explore within minutes of launch.

What you get:

PhotoPrism 260601 (AGPL-3.0) deployed from the official photoprism/photoprism Docker image, pinned so the image never silently upgrades at build time
Docker Engine (Docker CE) and the Docker Compose plugin, installed from the official Docker package repository
The PhotoPrism stack: the photoprism container (the Go application with bundled TensorFlow models, ffmpeg, libheif and RAW converters) and mariadb (mariadb:11, PhotoPrism's recommended index database), run together via Docker Compose on a private network
Automatic tagging and face recognition powered by the bundled TensorFlow models, running entirely on CPU, so no GPU instance is required
A system nginx reverse proxy on port 80 forwarding to PhotoPrism on 127.0.0.1:2342, with the WebSocket upgrade headers and a raised upload limit for large photos and videos
All stateful data (the MariaDB database, your imported originals and the thumbnail and sidecar storage tree) on a dedicated 64 GiB data disk mounted at /var/lib/photoprism. Docker's data-root is relocated there, and the disk is independently resizable and re-provisioned on every VM
A per-VM administrator account and fresh MariaDB user and root passwords, all generated at first boot, plus a small public-domain demo library indexed so the grid is populated on your first sign-in
Four systemd units: docker.service, nginx.service, photoprism.service (a wrapper around docker compose up -d) and photoprism-firstboot.service
24/7 SecureAnyCloud support

Prerequisites

You need an active Azure subscription, an SSH key, and a VNet with a subnet.

The recommended size is Standard_B2ms (2 vCPU / 8 GB RAM). PhotoPrism loads the TensorFlow classification and face models into memory, and MariaDB adds its buffer pool, so 8 GB gives comfortable headroom for indexing.

Configure these NSG inbound rules. Allow 22/tcp from your management CIDR for SSH. Allow 80/tcp from the CIDR that needs the PhotoPrism web app. Add 443/tcp if you enable HTTPS.

Connect over SSH

Replace <vm-ip> with the public IP of your VM. The default login user is azureuser.

ssh azureuser@<vm-ip>

Confirm the services are active

sudo systemctl is-active docker.service photoprism-firstboot.service photoprism.service nginx.service
sudo ss -tlnp | grep -E ':80 |2342'

The first command prints active four times. The ss output shows nginx listening publicly on port 80. PhotoPrism is bound to the loopback interface only, on 127.0.0.1:2342, so nginx is the only service exposed on the public interface.

Confirm the PhotoPrism containers are running

grep image /opt/photoprism/compose.yaml cd /opt/photoprism && sudo docker compose --env-file .env -f compose.yaml ps --format "table {{.Name}}\t{{.Image}}\t{{.Status}}"

The output lists the pinned image tags and the two containers, photoprism-photoprism-1 and photoprism-mariadb-1. Both are in the Up state, and MariaDB reports healthy.

Confirm the data disk and read the per-VM credentials

All stateful PhotoPrism data lives on a dedicated data disk mounted at /var/lib/photoprism. This includes the MariaDB database, your imported originals and the thumbnail and sidecar storage.

A unique administrator password and fresh database secrets are generated for your instance on its first boot. They are written to a root-only file.

df -h /var/lib/photoprism
sudo cat /root/photoprism-credentials.txt

The credentials file lists PHOTOPRISM_URL (where to sign in), PHOTOPRISM_ADMIN_USER (admin) and PHOTOPRISM_ADMIN_PASSWORD. Store the password in a safe place.

Check the endpoint and the security model

The nginx reverse proxy serves PhotoPrism's unauthenticated /api/v1/status readiness endpoint on port 80. Every protected action requires the per-VM administrator credentials.

curl -s http://localhost/api/v1/status U=admin
P=$(sudo grep '^PHOTOPRISM_ADMIN_PASSWORD=' /root/photoprism-credentials.txt | cut -d= -f2-)
curl -s -o /dev/null -w "wrong password -> HTTP %{http_code}\n" -X POST http://localhost/api/v1/session \
  -H 'Content-Type: application/json' -d "{\"username\":\"$U\",\"password\":\"wrong\"}"
curl -s -X POST http://localhost/api/v1/session -H 'Content-Type: application/json' \
  -d "{\"username\":\"$U\",\"password\":\"$P\"}" | grep -o '"access_token"' | head -1

/api/v1/status returns {"status":"operational"}. A wrong password is rejected with HTTP 401, and the correct per-VM password returns an access_token. Together these confirm that the appliance is up and that there is no default or shared login.

Sign in to PhotoPrism

Open http://<vm-ip>/ in your browser. Enter admin as the username and the PHOTOPRISM_ADMIN_PASSWORD from Step 4, then choose Sign in.

Browse your photo library

After you sign in, you land on the library grid. A small demo library of public-domain photos is already indexed, so the grid shows real thumbnails from the moment you arrive. Each tile shows the picture, its file name and its dimensions.

Click any picture to open it full screen in the viewer. There you can page through your photos, zoom, and open the details panel for the metadata, labels and location extracted on indexing:

Explore places, search and albums

The left navigation gives you the full PhotoPrism experience. It offers search across your whole library, an interactive Places map that plots geotagged photos, a Calendar view, Albums, Labels (the automatic AI tags), Faces and more.

To add your own photos, upload them from the web UI with the Upload button. Alternatively, copy files into /var/lib/photoprism on the data disk and start an index from the Library menu. PhotoPrism extracts the metadata, generates thumbnails, tags the content with machine learning and recognises faces.

The demo photos are sample content. You can select and delete them at any time.

Managing the stack

The PhotoPrism stack is wrapped by the photoprism.service systemd unit, which runs docker compose up -d from /opt/photoprism.

sudo systemctl restart photoprism.service
sudo systemctl status photoprism.service --no-pager

To inspect the application logs, tail the PhotoPrism container:

cd /opt/photoprism
sudo docker compose --env-file .env -f compose.yaml logs --tail 50 photoprism

PhotoPrism configuration lives in /opt/photoprism/compose.yaml, and the per-VM secrets live in /opt/photoprism/.env.

By default, this image disables PhotoPrism's quality-review filter, so all indexed photos appear in the main library view immediately. To approve lower-quality pictures before they show, re-enable review under Settings > Library.

Enabling HTTPS

The image serves plain HTTP on port 80. For any public deployment, put TLS in front with your own domain. Point a DNS A record at the VM public IP, then install a certificate with the certbot nginx plugin. The outline is:

Install certbot and the nginx plugin from the Ubuntu repositories.
Run certbot against your domain to obtain a certificate and install it into the nginx site.
Once nginx terminates TLS, set PHOTOPRISM_SITE_URL=https://your-domain/ in /opt/photoprism/.env. Then restart the stack with sudo systemctl restart photoprism.service so PhotoPrism generates correct https:// links and share URLs.

Use your own registered domain in place of the example domain.

Maintenance

The operating system receives unattended security updates.

To update PhotoPrism itself, edit the pinned image tag in /opt/photoprism/compose.yaml. Then, from /opt/photoprism, run sudo docker compose --env-file .env -f compose.yaml pull, followed by sudo systemctl restart photoprism.service. Always snapshot the /var/lib/photoprism data disk before a major version upgrade.

Support

SecureAnyCloud provides 24/7 support for this image. PhotoPrism and MariaDB are trademarks of their respective owners. SecureAnyCloud provides this image and is not affiliated with or endorsed by the PhotoPrism project or MariaDB.

Deploy on Azure

Launch PhotoPrism 260601 on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure

PhotoPrism is an AI-powered, open source, self-hosted application for browsing, organising and sharing your photo and video collection. It uses on-device machine learning to tag your pictures by their content and location, recognise faces and group similar shots, so you can find any photo with powerful search. It handles RAW files, live photos and videos, and presents everything in a fast, modern web interface with maps, calendars and albums.

This SecureAnyCloud Amazon Machine Image ships PhotoPrism 260601 (June 2026), fully installed and managed by systemd. It is served through an nginx reverse proxy on port 80 and is secure by default. A unique administrator password is generated for every instance on first boot, before the application starts, and the photo index ships empty.

What you get

PhotoPrism 260601, run from the official upstream container image (photoprism/photoprism:260601) and managed as a systemd service. The image bundles the TensorFlow model, ffmpeg, libheif and the RAW converters for automatic tagging, face recognition and format conversion. It runs entirely on the CPU, so no GPU is required.
nginx reverse proxy on port 80, forwarding to the application on loopback 127.0.0.1:2342. The application is never exposed directly.
Secure first boot. A fresh administrator password is generated per instance and written to a root-only file, and the photo index ships empty.
Dedicated data volume. Your original photos, the SQLite index database, the thumbnail cache and sidecar files live on a separate, independently resizable EBS volume mounted at /var/lib/photoprism, kept off the operating-system disk.
24/7 SecureAnyCloud support

Architecture at a glance

PhotoPrism is officially a Docker-first deployment. The upstream image bundles the machine-learning model and all the media tooling that a bare-metal install would otherwise require you to assemble by hand. This AMI runs that official, version-pinned image as a systemd-managed Docker container:

photoprism.service runs the container, bound to loopback 127.0.0.1:2342.
nginx.service reverse-proxies port 80 to the container, with the WebSocket upgrade headers PhotoPrism needs and a large upload limit for big photos and videos.
photoprism-firstboot.service runs before the application on the very first boot. It generates the per-instance administrator password, resolves the instance's public IP for the site URL, and writes the credentials to a root-only file.

The originals and the storage tree (index database, thumbnails, sidecar files) live under /var/lib/photoprism on a dedicated EBS data volume.

Connecting to your instance

Connect over SSH as the default login user for your AMI's operating system. Use the EC2 key pair you launched the instance with:

OS variant SSH login user

Ubuntu 24.04 ubuntu

ssh -i /path/to/your-key.pem ubuntu@<instance-public-ip>

First sign-in

The administrator username is admin, and a unique password was generated for your instance on first boot. Retrieve the password over SSH:

sudo cat /root/photoprism-credentials.txt

This prints the per-instance credentials, for example:

PHOTOPRISM_URL=http://<instance-public-ip>/ PHOTOPRISM_ADMIN_USER=admin PHOTOPRISM_ADMIN_PASSWORD=<unique-per-instance-password>

Browse to http://<instance-public-ip>/ and sign in as admin with that password.

Tip: PhotoPrism derives links from its site URL, which first boot set to your instance's public IP. If you put the instance behind a load balancer or a custom domain, update PHOTOPRISM_SITE_URL in /etc/photoprism/photoprism.env and restart the service. See Enabling HTTPS below.

Adding and indexing photos

There are two ways to get photos into PhotoPrism:

Upload through the web interface. Click the upload button in the top toolbar and drag in your photos and videos. PhotoPrism imports them, generates thumbnails and indexes them automatically.
Copy files into the originals folder, then index. Copy your media onto the instance under the originals directory, then start an index from the library menu:

bash sudo install -d -o photoprism -g photoprism /var/lib/photoprism/originals/MyPhotos # ... copy your files into /var/lib/photoprism/originals/MyPhotos ... sudo chown -R photoprism:photoprism /var/lib/photoprism/originals

In the web interface, open Library > Index and start indexing. PhotoPrism reads every file under originals/, extracts EXIF metadata, generates thumbnails, classifies the content with TensorFlow and detects faces.

When indexing completes, your photos appear in the library, automatically labelled by their content (for example landscape, animal or architecture). You can search them by those labels, by date, by place and by the people PhotoPrism recognises.

Browsing, searching and photo details

Open any photo to see its details: title, date, location, camera metadata and the labels that machine learning assigned to it. From the tabs at the top of the detail view, you can edit the title and caption, correct the date and location, and manage the labels and recognised people.

The search bar understands natural queries such as mountain, dog, 2024 italy or label:portrait. It combines the automatic labels, places, dates and people into a single fast search across your whole library.

Organising photos into albums

Group related photos into albums from the Albums section. Create an album, then select photos in the library and choose Add to album. You can mark albums as favourites and share them.

PhotoPrism also builds smart views automatically. Places plots your photos on a map from their GPS metadata, Calendar groups them by month, People gathers the faces it recognises, and Labels lists everything its machine-learning model has tagged.

Managing the service

Manage the application and the reverse proxy with systemctl:

# Service health systemctl is-active photoprism.service nginx.service

active active

# The container that runs PhotoPrism
sudo docker ps --format 'table {{.Image}}\t{{.Status}}\t{{.Ports}}'

IMAGE STATUS PORTS photoprism/photoprism:260601 Up 16 minutes 127.0.0.1:2342->2342/tcp, 2442-2443/tcp

# Unauthenticated health endpoint, proxied through nginx on port 80 curl -s http://127.0.0.1/api/v1/status

{"status":"operational"}

After a configuration change, restart PhotoPrism with sudo systemctl restart photoprism.service. Configuration lives in /etc/photoprism/photoprism.env, and your data lives under /var/lib/photoprism.

Backups

PhotoPrism keeps everything that matters under /var/lib/photoprism:

originals/ holds your original photos and videos.
storage/ holds the SQLite index database, the thumbnail cache and the YAML sidecar files that mirror each photo's metadata.

To back up, stop the service briefly and archive the data directory, or snapshot the EBS data volume:

sudo systemctl stop photoprism.service
sudo tar czf /tmp/photoprism-backup.tgz -C /var/lib/photoprism .
sudo systemctl start photoprism.service

Because the data sits on its own EBS volume, an EBS snapshot of that volume is the simplest backup. Schedule it with Amazon Data Lifecycle Manager.

Switching to MariaDB

SQLite is the default index and is fine for personal and small-team libraries. For very large libraries or higher concurrency, point PhotoPrism at MariaDB by editing /etc/photoprism/photoprism.env:

PHOTOPRISM_DATABASE_DRIVER=mysql PHOTOPRISM_DATABASE_SERVER=<host>:3306 PHOTOPRISM_DATABASE_NAME=photoprism PHOTOPRISM_DATABASE_USER=photoprism PHOTOPRISM_DATABASE_PASSWORD=<password>

Then restart the service. See the PhotoPrism database documentation for migrating an existing SQLite library.

Enabling HTTPS

The image serves plain HTTP on port 80, so you can terminate TLS where it suits your architecture:

At a load balancer or CloudFront. Terminate TLS upstream and forward HTTP to the instance. Set PHOTOPRISM_SITE_URL in /etc/photoprism/photoprism.env to your public https:// URL, then restart the service so generated links use it.
On the instance with Let's Encrypt. Point a DNS name at the instance, then run these commands:

bash sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx sudo certbot --nginx -d your-domain.example.com

certbot obtains a certificate and reconfigures nginx for HTTPS automatically. Update PHOTOPRISM_SITE_URL to the https:// URL and restart PhotoPrism.

Support

SecureAnyCloud provides 24/7 technical support for this image by email and chat. Support covers PhotoPrism deployment, indexing and import configuration, face recognition, backups, switching to MariaDB, TLS termination and scaling.

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.

Deploy on AWS

Launch PhotoPrism with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on AWS