Immich replaces Google Photos once you budget for a mini PC and real backups

On 2 July 2026, Immich shipped version 3.0. The move to VectorChord for vector search, underway since version 1.133 in May 2025, is now mandatory: support for the older pgvecto.rs extension is dropped, and instances that never finished that migration cannot jump straight to 3.x. Thirteen days later, 3.0.3 patched an access-control bug in album sharing, tracked as CVE-2026-59258 with a CVSS score of 8.3: an album editor could promote themselves to owner and demote the real owner in the process.

That release cadence is a good excuse to evaluate the project on facts rather than enthusiasm. Google killed free unlimited storage for Google Photos back in June 2021; in 2026 the service sits inside Google’s “AI Pro” bundle, priced in tiers: roughly $2.99 a month for 200GB, $9.99 for 2TB in the US, with European pricing running higher. Immich costs only hardware, power, and the time you are willing to spend on it. Whether that time is worth the savings is the actual question.

Where the project stands in mid-2026

Immich left beta on 1 October 2025 with version 2.0.0. From that point the team committed to major-version compatibility between mobile and server (any 2.x client works with any 2.x server) and to zero-step upgrades — docker compose pull && docker compose up -d, except across a major version bump like the one in July 2026. A month before 3.0, the project published a retrospective on its first two years under FUTO, the nonprofit that pays its core staff: three developers went full-time on 1 May 2024, the paid team now numbers around ten people spread across the world, and the funding model still runs on voluntary product-key purchases. Nothing in Immich is currently locked behind a paywall.

The release log backs up that maturity claim: 2.6 in March, 2.7 in April, 3.0 in early July, each followed by security fixes within days rather than months. Version 3.0 also ships two features that matter for anyone running a personal library day to day — an integrity-check job that compares files on disk against the database and flags orphaned assets or mismatched checksums, and a rewritten background-backup pipeline on Android using a new periodic task scheduler, addressing a reliability complaint that had sat open in the project’s issue tracker for a long time.

The hardware you actually need

Official docs list 6GB of RAM and 2 CPU cores as the floor, 8GB and 4 cores as the comfortable recommendation, especially during large imports. One new trap arrived with 3.0: the machine-learning container on amd64 now requires a CPU that supports the x86-64-v2 instruction set, a bar nearly every chip sold since 2012 clears, except the low-power Atom or entry Celeron boards still running inside some older NAS boxes. Arm64 hardware (Raspberry Pi 4 and 5, most current Synology and QNAP units) sidesteps that specific requirement, but stays noticeably slower at face recognition and similarity search without dedicated acceleration.

Storage needs padding, too: thumbnail generation and video transcoding add 10 to 20 percent on top of the raw library size, so budget roughly 600GB of usable disk for 500GB of original photos and video. A GPU is not required to get started, but it earns its keep past a few tens of thousands of photos or a 4K video collection: NVENC, Quick Sync and VAAPI all work for transcoding, and CUDA remains the most reliable backend for accelerating face recognition and semantic search — though mixing GPU vendors across separate worker nodes is currently unsupported.

For a household library, the realistic 2026 target is an N305-class mini PC with 16 to 32GB of RAM and a 1TB NVMe drive: that class of machine runs about $250 to $300 from generic resellers, before import duties or VAT for buyers outside the US. An existing Synology or QNAP box does the job just as well, as long as it clears the RAM floor above.

A docker-compose file that actually runs

Here is the minimal shape, matching the project’s own docker/docker-compose.yml:

name: immich

services:
  immich-server:
    container_name: immich_server
    image: ghcr.io/immich-app/immich-server:${IMMICH_VERSION}
    volumes:
      - ${UPLOAD_LOCATION}:/data
      - /etc/localtime:/etc/localtime:ro
    env_file: [.env]
    ports: ['2283:2283']
    depends_on: [redis, database]
    restart: always

  immich-machine-learning:
    container_name: immich_machine_learning
    image: ghcr.io/immich-app/immich-machine-learning:${IMMICH_VERSION}
    volumes: [model-cache:/cache]
    env_file: [.env]
    restart: always

  redis:
    container_name: immich_redis
    image: docker.io/valkey/valkey:9
    restart: always

  database:
    container_name: immich_postgres
    image: ghcr.io/immich-app/postgres:14-vectorchord0.4.3-pgvectors0.2.0
    environment:
      POSTGRES_PASSWORD: ${DB_PASSWORD}
      POSTGRES_USER: ${DB_USERNAME}
      POSTGRES_DB: ${DB_DATABASE_NAME}
    volumes: [${DB_DATA_LOCATION}:/var/lib/postgresql/data]
    shm_size: 128mb
    restart: always

volumes:
  model-cache:

Three details save real debugging time. First, the official file also pins the Postgres image by an exact SHA-256 digest for full reproducibility, worth doing in production but dropped here for readability, but pull it fresh from github.com/immich-app/immich/releases/latest rather than copying it from any blog post, this one included: that image changes on every major bump. Second, pin IMMICH_VERSION to an exact tag (v3.0.3, not release) in .env; a floating tag upgrades your whole stack on the next restart, on Docker’s schedule rather than yours. Third, never expose port 2283 directly to the internet. Put a reverse proxy with authentication in front of it, or better, keep it behind a private network like Tailscale — the setup wizard that opens on first boot creates the admin account with no protection at all while that port stays open.

Your new attack surface

Self-hosting means becoming your own security team. Over the past year, Immich shipped fixes for an OAuth2 account-takeover bug (unchecked state parameter, CVSSv4 8.8, mid-2025), a privilege-escalation flaw where an API key could grant itself admin rights (fixed in 2.5.0), a stored cross-site-scripting issue in the 360-degree panorama viewer, and the album-sharing bug already mentioned. None of that is unusual for a project moving this fast; at Google, though, that patching work is invisible to the end user, handled by a full-time security team. Running your own instance means reading release notes and applying fixes within days of disclosure, not whenever you get around to it.

Backups: the job Google used to do without asking

An Immich instance holds two things worth protecting separately: the original files under UPLOAD_LOCATION, and the Postgres database carrying metadata, albums, recognized faces, and share links. Since the 2.x line, Immich automatically writes database dumps to UPLOAD_LOCATION/backups, configurable from the admin panel — a real improvement over scripting that step yourself. A manual export is still worth running to confirm the pipeline works:

docker exec -t immich_postgres pg_dumpall --clean --if-exists \
  --username=postgres | gzip > immich-db-$(date +%F).sql.gz

That automatic dump is not an off-site backup. The 3-2-1 rule applies here without exception: three copies, two different media, one copy stored somewhere else entirely. A scheduled rclone sync to an object-storage bucket covers that last copy cheaply: a 1TB Hetzner Storage Box runs €3.20 a month before tax, and Backblaze B2 charges about $6 per terabyte per month with free egress up to three times what you store. To move an existing Google Photos library over, the community tool immich-go reads Google Takeout ZIP archives directly without unpacking them first, and preserves capture dates, GPS data, and album membership — a step where homegrown import scripts routinely fall apart.

What Google still does better

Google keeps a real edge on three fronts. Search comes first: Ask Photos, running on Gemini, understands natural-language queries like “the photo where we all wore ugly Christmas sweaters,” and on 20 July 2026 gained a toggle to switch between classic search and Ask Photos on demand. Immich’s CLIP-based search handles keywords, faces, and objects well, but stays literal. Generative editing is second: Google’s “Help me edit” and Nano Banana tools rewrite a photo from a plain-text instruction, while Immich has offered only non-destructive crop and rotate since 3.0. Sharing with non-technical relatives is third: a Google Photos link opens with nothing to install or explain, while sharing from Immich usually means walking someone through what a self-hosted instance even is.

The verdict

If you already own a NAS, or can put roughly $300 into an N305-class mini PC with 16GB of RAM, and you are willing to pay $3 to $6 a month for an encrypted off-site copy and apply fixes within a week of each disclosed CVE, Immich replaces Google Photos with no serious functional loss for a household library — and you gain an uncapped storage ceiling plus full control over your own data. If you have neither the time to track the project’s release notes nor the budget for off-site backup, or if conversational search and generative editing matter more to you than privacy, stay on Google Photos, or run Immich alongside it as a second copy rather than a full replacement. The worst outcome of the two is a migration with no real backup behind it, where a single failed drive erases what Google would never have lost.

References

• Release v2.0.0 — Stable, immich-app/immich, 1 October 2025.
• Release v3.0.0, Immich Blog, 2 July 2026.
• Release v3.0.3, immich-app/immich, 15 July 2026.
• FUTO — 2 years later, Immich Blog, 1 June 2026.
• Requirements, Immich documentation.
• Hardware Transcoding, Immich documentation.
• Backup and Restore, Immich documentation.
• immich before 3.0.3 contains a broken access control vulnerability — GHSA-mxpm-jvrh-gcj5, GitHub Advisory Database.
• CVE-2026-23896: Immich Privilege Escalation Vulnerability, SentinelOne.
• CVE-2025-43856: OAuth2 Account Hijacking Flaw Found in Immich, Security Online.
• Google Photos gets a toggle between classic search and Ask Photos, 9to5Google, 20 July 2026.
• Google One (AI Pro): Storage Plans and Prices for 2026, Spliiit.
• Storage Box BX11, Hetzner.
• B2 Cloud Storage Pricing, Backblaze.
• immich-go, simulot, GitHub repository.