Self-hosted photo stack
Immich on Synology NAS: Container Manager Setup and Ownership Guide
Immich can run well on a capable Synology NAS, but installing it is not the same as installing a normal DSM package. The documented Synology path is a community contribution built around Container Manager and Docker Compose. That means the NAS owner is operating an application stack containing Immich services and PostgreSQL, and must protect both the database and the actual image/video library. The payoff is a powerful self-hosted photo experience; the cost is ongoing application ownership.
Quick answer
Use Container Manager, but design storage and backup before the first upload
Create a dedicated project directory, keep PostgreSQL data on appropriate local storage, define the media library location, import the Compose and environment files into Container Manager, configure firewall access if required, and confirm the stack is healthy before sending a large phone library. Back up database and media separately because Immich explicitly warns that its database backup does not contain the uploaded images and videos.
Live Amazon products
Current hardware for this workflow
This Sprint 9E catalogue is intentionally small: it surfaces current and previous Synology systems relevant to photo, backup and remote-access ownership decisions, while compatible third-party NAS drives can be read from Cloudzat Storage Price Intelligence in read-only mode. Hardware cards support the workflow; they do not replace the application and recovery guidance on each page.
Owner decision
A suitable Synology is one that can run the stack you will actually maintain
Immich needs more than raw disk capacity. Budget RAM for containers, CPU for jobs and machine learning, reliable database storage, sufficient free space for thumbnails and derivatives, and a backup target. If the NAS is also serving Plex, surveillance or many containers, consider whether Immich should share that system or use separate compute.
Interactive owner tool
Immich on Synology Fit Checker
Use this as a planning aid. It identifies missing reliability layers and the simplest likely direction, but it does not replace current Synology, Immich, Backblaze, Google or Tailscale documentation for the exact service and software version.
Owner reliability checklist
Four checks before trusting the new workflow
Protect the original data
A photo or backup application is not the final safety layer. Know where originals live and keep an independent copy outside the primary NAS.
Design remote access by user role
Family photo access, private administrator access and public sharing do not need the same exposure or credentials.
Document recovery secrets
Encryption keys, cloud credentials, tailnet access and DSM accounts should remain recoverable even when the original NAS is unavailable.
Test before deleting the old copy
Migration and backup jobs are complete only after representative files restore, metadata looks correct and the next administrator can follow the procedure.
Confirm that your DiskStation supports Container Manager
The Synology community installation documented by Immich assumes Container Manager is available. Entry models without the required package or architecture are not good candidates for this workflow, regardless of how much raw drive capacity they offer.
Check the exact model before planning the migration. If your current Synology cannot host the stack comfortably, it may still be excellent storage for an Immich server running on a mini PC or other compute node.
Create a dedicated application directory
Immich’s Synology guide recommends a Docker-oriented directory layout with separate folders for the project, PostgreSQL data and photo library. Keeping these roles explicit makes permissions, backup and troubleshooting easier than scattering volumes across arbitrary shares.
A tidy layout also reduces upgrade mistakes. The Compose file and environment configuration should be recoverable independently of the media library, while the database path should be treated as application data rather than ordinary photo storage.
Keep PostgreSQL storage local to the server environment
Immich’s quick-start documentation warns that network shares are not supported for the database data location. On a Synology installation, that means the PostgreSQL volume should live on appropriate local NAS storage rather than pointing the database itself at a remote SMB or NFS share.
The photo library can be large and capacity-oriented, but the database values latency and consistency. Treating those two data types identically is a common self-hosting mistake.
Container Manager projects are easier to reproduce than hand-built containers
The documented Synology workflow imports an existing docker-compose.yml into a Container Manager Project. That keeps the service relationships and environment variables together instead of creating containers individually through the GUI.
Store a clean copy of your Compose and environment template outside the live project directory, with secrets handled appropriately. Recovery is much easier when you can recreate the stack from documented configuration rather than remembering which buttons were clicked months earlier.
Firewall rules can block a healthy container
Immich’s Synology guide specifically calls out firewall configuration after the containers start. If DSM firewall rules are enabled, the browser may be unable to reach the application even though the Immich containers themselves are running correctly.
Diagnose from inside out: verify container health, confirm the assigned network and port, test local access, then examine DSM firewall policy. Avoid weakening the entire firewall simply because one application path was not defined.
RAM demand grows with the rest of your container stack
Immich’s current quick start calls for at least 6GB of RAM and two CPU cores as a baseline system requirement. On a NAS, the operating system, filesystem cache and any other packages also consume memory.
A DS425+ can be suitable for a lighter stack, while systems such as DS925+, DS1525+ and DS1825+ provide much larger ECC memory ceilings for owners running multiple services. Buy memory around measured pressure, not a fashionable maximum.
Machine learning is a separate workload
Photo ingestion triggers jobs beyond simple file copying: thumbnail generation, metadata extraction and machine-learning analysis can keep the server busy long after upload completes. That is normal during first import.
If recognition performance is important, consider the CPU architecture and whether you want machine-learning work on the NAS or another host. Cloudzat’s existing Immich hardware cluster can help size dedicated compute when the photo service becomes more demanding than the storage appliance should handle.
Use the mobile app only after the server path is stable
Immich mobile can select albums and enable backup, but uploading thousands of photos into a stack that is still being tuned makes failures difficult to interpret. First upload a small test set from the web and mobile clients, then inspect job queues and storage placement.
Once the test survives a restart and a small restore exercise, expand to the full mobile library. This staged approach catches path, permission and firewall errors before they are mixed with a multi-terabyte migration.
Database backups do not include the originals
Immich’s documentation is explicit: built-in database backups contain metadata and user information, not the actual files stored in the upload location. You therefore need two protected components for a recoverable service.
Back up the media library through Hyper Backup or another tested file-level strategy, and preserve database backups in a location protected by that larger plan. A successful restore requires both pieces and the application configuration used to bring them together.
Updates should be deliberate
Immich evolves quickly. Follow release notes and upgrade guidance rather than allowing an unattended image updater to change the whole stack without a recovery point.
Before a meaningful version change, verify current backups, keep the Compose configuration, and know how to roll back or restore the database if the application migration fails. Fast feature development is an advantage only when change management is equally disciplined.
Remote access deserves its own security design
A self-hosted photo application is useful only if trusted users can reach it, but direct public exposure should not be the default simply because the service runs on port 2283.
Tailscale can provide remote access to the Synology without opening firewall ports, or an experienced administrator can use a properly configured reverse proxy with TLS and authentication. Choose one documented access architecture instead of layering ad-hoc port forwards.
Know when separate compute is the cleaner architecture
If the Synology is already busy with backups, surveillance, Plex and storage tasks, another container-heavy service can make every workload harder to diagnose. Running Immich compute on a mini PC while keeping the photo library on NAS storage can separate failure domains and allow easier hardware upgrades.
The all-in-one Synology deployment is still attractive for smaller households because it reduces the number of devices. The correct answer is workload-dependent: simplicity favors one capable NAS, while performance isolation and experimentation can favor separate compute.
Questions people ask
Immich on Synology questions
Is Immich officially supported on Synology?
Immich publishes a Synology community installation guide, but labels it community-contributed rather than officially supported by the Immich team.
Do I need Container Manager?
The documented Synology installation uses Container Manager and Docker Compose. Verify that the exact DiskStation supports the package.
How much RAM does Immich need?
Immich’s current quick start lists at least 6GB of RAM and two CPU cores for the system. Additional NAS services increase the practical requirement.
Can the Immich database live on a network share?
Immich documentation says network shares are not supported for DB_DATA_LOCATION. Keep PostgreSQL storage on appropriate local server storage.
What port does Immich use?
The standard Compose setup exposes the web service on port 2283 unless you intentionally change the configuration.
Do Immich database backups include photos?
No. Immich warns that database backups protect metadata and user information, while the image/video files in the upload location require a separate backup.
Can I use Synology Photos and Immich together?
Yes, but plan storage ownership carefully. Avoid two applications independently modifying the same originals without clear rules.
Can I access Immich remotely through Tailscale?
Yes. Tailscale can provide private access to the Synology without public firewall ports, assuming the client and access policies are configured.
Is DS925+ good for Immich?
Its four bays, ECC memory and 32GB memory ceiling make it a capable storage and container platform. Machine-learning expectations and other concurrent services determine whether separate compute is preferable.
Should I install automatic container updates?
For an important photo archive, deliberate updates with known backups are safer than unattended changes to the full stack.
Official references and methodology
Verify the exact service, data path and recovery plan
The guide follows Immich’s current Synology community instructions and quick-start requirements and separates the PostgreSQL database, uploaded media, application configuration and remote access into independent operational responsibilities. It does not treat a working web login as proof that backups or upgrades are safe.
- Immich Synology community installation
- Immich quick start
- Immich Docker Compose installation
- Tailscale Synology integration
- Hyper Backup DSM 7.4 specifications
As an Amazon Associate, Cloudzat may earn from qualifying purchases. Prices, NAS models, DSM behavior, application versions and service documentation can change. Verify the exact Synology model and the current Synology, Immich, Backblaze, Google or Tailscale documentation before changing a production photo, backup or remote-access workflow.