How to Configure Immich External Libraries as Read-Only Sources

Eva Wong

IceWhale author

Eva Wong is the Technical Writer and resident tinkerer at ZimaSpace. A lifelong geek with a passion for homelabs and open-source software, she specializes in translating complex technical concepts into accessible, hands-on guides. Eva believes that self-hosting should be fun, not intimidating. Through her tutorials, she empowers the community to demystify hardware setups, from building their first NAS to mastering Docker containers.

How to Configure Immich External Libraries as Read-Only Sources - Zima Store Online

An Immich external library indexes photos that already live outside its managed upload tree. Mounting that source read-only protects originals from application or operator mistakes, but Immich still needs writable storage for thumbnails, encoded video, profile data, and database state.

The setup therefore uses two trust zones: immutable source folders and writable generated data. A small pilot library should pass discovery, metadata, thumbnail, rescan, and removal tests before a large archive is added. The same pilot also proves that the container path, ownership, and recovery plan agree.

Map Source and Managed Storage Separately

Choose a host path for the existing archive and a distinct container path such as /external/family-photos. Do not place it beneath Immich upload storage, because external and managed assets follow different lifecycle rules.

The Immich external-library workflow requires the server to see the path that will be assigned to a user. Record both sides of the mount so the administrator does not paste a host-only path into the application.

Confirm that Immich writable locations for uploads, thumbnails, encoded video, and database data have normal backup and free-space monitoring. Read-only originals do not protect generated state or the asset records that make the library usable.

Apply a Read-Only Container Mount

Add the archive as a bind mount with the read-only flag in Compose or the container manager. A typical pattern maps /srv/photos/archive on the host to /external/archive in the container with :ro.

Grant the container process traverse and read permission on every parent directory. Read-only does not mean permission-free: missing execute permission on a directory prevents discovery even when individual files are readable.

If the source is a network share, stabilize the host mount before the container starts. The Immich network-share reliability guide covers the difference between an available path and a reliable application dependency.

Add a Pilot External Library and Scan It

Create or select the owning Immich user, add an external library, and enter the container-visible import path. Begin with a directory containing copies or noncritical originals rather than pointing at the complete archive.

Run a scan and verify that expected photo and video counts appear. Open assets from nested folders, inspect dates and locations, and confirm that thumbnails and encoded previews are written to managed storage rather than beside the originals.

At the host, compare modification times or hashes for the pilot source before and after the scan. Also try to create a file in the mounted path from inside the container; the operation should fail while reading succeeds.

-15% OFF

ZimaBoard 2 - Mini Home Server for Your Big Idea

Single board computer zimaboard2

Test Rescan, Missing Files, and Recovery

Add one file to the host source, run a rescan, and confirm that it appears. Then temporarily move a pilot file out of the source, rescan, and observe how the installed Immich version marks or removes the asset record before repeating this on real data.

Back up the database and writable Immich data according to your normal recovery plan. The external originals need their own independent backup because a read-only application mount does not protect against disk failure, host-side deletion, or corruption.

The pass condition is that Immich can index and render the archive, cannot write to it, and can be rebuilt without treating the external source as managed uploads. Stop if generated files appear beside originals or a missing mount is mistaken for an empty library.

Frequently Asked Questions

Does a Read-Only Mount Prevent Immich From Deleting the Original? It prevents writes through that container mount. It does not protect against host-side deletion, another writable share, filesystem failure, or an administrator changing the mount mode.

Where Do Thumbnails Go for an External Library? They remain in Immich-managed writable storage. Keep that location separate from the read-only originals and include it with the database in the recovery plan.

Can Several Users Index the Same External Folder? Avoid overlapping ownership until you have tested the exact release behavior. Duplicate indexing can create confusing ownership and sharing results.