Expose Immich with Docker

Add the agent to the same Compose project as Immich. It reaches the Immich service over the project network; you do not need to forward a router port.

Before you start

Confirm your Immich service is named immich-server and listens on port 2283. If your Compose file differs, use its service name and port instead. Create the Immich admin account locally before sharing the public URL.

1. Create the tunnel

In the dashboard, create a proxy tunnel with Target: http://immich-server:2283. Copy the kpt_… agent token and keep it private.

2. Add the agent

Add this service to Immich's compose.yml or an override file in the same project:

services:
  kepeink-agent:
    image: registry.kepeink.hu/agent:2
    restart: unless-stopped
    environment:
      KEPEINK_AGENT_TOKEN: ${KEPEINK_AGENT_TOKEN}
    volumes:
      - kepeink-agent-data:/home/nonroot

volumes:
  kepeink-agent-data:

Put KEPEINK_AGENT_TOKEN=kpt_xxxxxxxx in the project's .env, then run docker compose up -d kepeink-agent. The named volume preserves the agent's certificate state across container recreations.

3. Check the URL

Open the assigned HTTPS URL. If it fails, check docker compose logs kepeink-agent and confirm both services are in the same Compose project. Immich's local LAN URL can still be used directly. For more network layouts, see Run the agent with Docker.