Deploying immich with AppJail and Director

[DtxdF]

Thank you very much for creating this project. Actually, this is the final boss we face: providing OCI images. Yes, we have OCI on FreeBSD, but we don't have OCI images. It's like creating the best operating system without applications, so this is a good place to start.

Currently, AppJail supports OCI, so I can easily deploy OCI containers, but AppJail predates the appearance of OCI on FreeBSD, so my alternative was AppJail images, which are simply tar files with a specific structure and metadata (appjail-ajspec(5)). The problem with this approach is that it is tied exclusively to AppJail, so any other jail management that implements images with its own structure will not be able to take advantage of it. AFAIK the jail management frameworks that implement images are AppJail, CBSD, pot, and vessel. But only CBSD and AppJail are compatible with OCI, which means that if I create an OCI image and use AppJail as my container deployment tool, CBSD folks or even podman can use that image.

Of course, the big challenge is not just creating OCI images, but maintaining them, and this is what the daemonless project does in an automated way. IMHO this is what it does very well.

But I'm rambling too much...

.env:

UPLOAD_LOCATION=/var/appjail-volumes/immich/library
DB_DATA_LOCATION=/var/appjail-volumes/immich/postgres
CACHE_LOCATION=/var/appjail-volumes/immich/cache
REDIS_DATA_LOCATION=/var/appjail-volumes/immich/redis
TZ=America/Caracas
DB_PASSWORD=postgres
DB_USERNAME=postgres
DB_DATABASE_NAME=immich
DIRECTOR_PROJECT=immich

appjail-director.yml:

options:
  # Equivalent to 'network_mode: host'
  - alias:
  - ip4_inherit:
services:
  immich-server:
    name: immich_server
    priority: 100
    options:
      - container: boot
      - from: ghcr.io/daemonless/immich-server:latest
    volumes:
      - immich-data: /data
    oci:
      environment:
        - DB_HOSTNAME: 127.0.0.1
        - REDIS_HOSTNAME: 127.0.0.1
        - IMMICH_MACHINE_LEARNING_URL: http://127.0.0.1:3003
        - TZ: !ENV '${TZ}'
  immich-machine-learning:
    name: immich_machine_learning
    options:
      - container: boot
      - from: ghcr.io/daemonless/immich-ml:latest
    oci:
      environment:
        - HF_HOME: /cache/huggingface
        - MPLCONFIGDIR: /tmp
        - TZ: !ENV '${TZ}'
    volumes:
      - model-cache: /cache
  redis:
    name: immich_redis
    options:
      - container: boot
      - from: ghcr.io/daemonless/redis:latest
    oci:
      environment:
        - LANG: C.UTF-8
        - TZ: !ENV '${TZ}'
    volumes:
      - redis-data: /config
  database:
    name: immich_postgres
    options:
      - container: boot
      - from: ghcr.io/daemonless/immich-postgres:latest
      - template: !ENV '${PWD}/immich-postgres-template.conf'
    oci:
      environment:
        - POSTGRES_PASSWORD: !ENV '${DB_PASSWORD}'
        - POSTGRES_USER: !ENV '${DB_USERNAME}'
        - POSTGRES_DB: !ENV '${DB_DATABASE_NAME}'
    volumes:
      - db-data: /var/lib/postgresql/data
volumes:
  immich-data:
    device: !ENV '${UPLOAD_LOCATION}'
    owner: 1000
    group: 1000
  model-cache:
    device: !ENV '${CACHE_LOCATION}'
  redis-data:
    device: !ENV '${REDIS_DATA_LOCATION}'
  db-data:
    device: !ENV '${DB_DATA_LOCATION}'

immich-postgres-template.conf:

exec.start: "/bin/sh /etc/rc"
exec.stop: "/bin/sh /etc/rc.shutdown jail"
sysvmsg: new
sysvsem: new
sysvshm: new
mount.devfs
persist

Makejail:

OPTION overwrite=force

Console:

# appjail-director up
Starting Director (project:immich) ...
Creating database (immich_postgres) ... Done.
 - Configuring the environment (OCI):
   - POSTGRES_PASSWORD ... Done.
   - POSTGRES_USER ... Done.
   - POSTGRES_DB ... Done.
Starting database (immich_postgres) ... Done.
Creating immich-machine-learning (immich_machine_learning) ... Done.
 - Configuring the environment (OCI):
   - HF_HOME ... Done.
   - MPLCONFIGDIR ... Done.
   - TZ ... Done.
Starting immich-machine-learning (immich_machine_learning) ... Done.
Creating redis (immich_redis) ... Done.
 - Configuring the environment (OCI):
   - LANG ... Done.
   - TZ ... Done.
Starting redis (immich_redis) ... Done.
Creating immich-server (immich_server) ... Done.
 - Configuring the environment (OCI):
   - DB_HOSTNAME ... Done.
   - REDIS_HOSTNAME ... Done.
   - IMMICH_MACHINE_LEARNING_URL ... Done.
   - TZ ... Done.
Starting immich-server (immich_server) ... Done.
Finished: immich
# appjail logs | grep -e immich | grep '2026-03-06'
jails  immich_postgres                                 console         2026-03-06.log
jails  immich_postgres                                 container       2026-03-06.log
jails  immich_redis                                    console         2026-03-06.log
jails  immich_redis                                    container       2026-03-06.log
jails  immich_server                                   console         2026-03-06.log
jails  immich_server                                   container       2026-03-06.log
jails  immich_machine_learning                         console         2026-03-06.log
jails  immich_machine_learning                         container       2026-03-06.log
# appjail logs tail jails/immich_server/container/2026-03-06.log -f
[Nest] 98541  - 06/03/2026, 14:39:47     LOG [Api:RouterExplorer] Mapped {/api/view/folder, GET} route
[Nest] 98541  - 06/03/2026, 14:39:47     LOG [Api:RoutesResolver] WorkflowController {/api/workflows}:
[Nest] 98541  - 06/03/2026, 14:39:47     LOG [Api:RouterExplorer] Mapped {/api/workflows, POST} route
[Nest] 98541  - 06/03/2026, 14:39:47     LOG [Api:RouterExplorer] Mapped {/api/workflows, GET} route
[Nest] 98541  - 06/03/2026, 14:39:47     LOG [Api:RouterExplorer] Mapped {/api/workflows/:id, GET} route
[Nest] 98541  - 06/03/2026, 14:39:47     LOG [Api:RouterExplorer] Mapped {/api/workflows/:id, PUT} route
[Nest] 98541  - 06/03/2026, 14:39:47     LOG [Api:RouterExplorer] Mapped {/api/workflows/:id, DELETE} route
[Nest] 98541  - 06/03/2026, 14:39:47     LOG [Api:NestApplication] Nest application successfully started
[Nest] 98541  - 06/03/2026, 14:39:47     LOG [Api:Bootstrap] Immich Server is listening on http://127.0.0.1:2283 [v2.5.6] [production] 
[Nest] 98541  - 06/03/2026, 14:39:47     LOG [Api:MachineLearningRepository] Machine learning server became healthy (http://127.0.0.1:3003).

btw I don't need annotations to implement jail parameters because they are in a appjail-template(5) but great contribution for OCI runtimes that don't support them.

[ahze]

Wow, this is absolutely fantastic! I’m honestly blown away -- seeing Daemonless images paired with AppJail and Director is such a huge milestone! It’s the perfect validation of the project's core philosophy: providing high-quality, native FreeBSD jails that stay flexible and independent.

I also love how AppJail handles this so cleanly. Since parameters are in an appjail-template(5), you don't even need annotations.

Your setup is such a great blueprint, and it feels like the perfect segue for 'Non-Podman' information on daemonless.io. I’d love to work together to make this a first-class citizen in the guides and deployment sections, and I'm wide open to any ideas you have on how to present this or other ways we can collaborate.

Let’s keep the conversation going!

[DtxdF]

Thanks for this!

Yeah, I can add information about AppJail to your images. This helps me a lot because it allows me to test the OCI feature in AppJail.

Another thing is adding more images. Perhaps the GitHub organization that hosts Makejails could give us some inspiration.