Immich is a wonderful little photo vault for your home server. It eats photos, sorts memories, and makes your phone feel lighter. But sometimes Docker says, “Nope, permission denied.” That is when people look for root login inside an Immich Docker setup. Good news. You usually do not need a real root “login.” You just need a safe root shell for a few minutes.

TLDR: For Immich in Docker, do not enable SSH root login inside the container. Use docker compose exec -u root to open a temporary root shell instead. For example, run docker compose exec -u root immich_server sh from your Immich folder. In a common home setup with 50,000 photos, one permission mistake on the upload folder can stop uploads for every user, so fixing ownership quickly matters.

What “root login” means in Docker

In a normal Linux server, root login means signing in as the superuser. Root can do everything. It can fix things. It can also break things. Very fast.

In Docker, the idea is a little different. Containers are small worlds. They run one app, or one service. Immich uses several services, such as the server, database, Redis, and machine learning container.

So when you say root login for Immich Docker, you probably mean one of these things:

• You want to enter the Immich container as root.
• You want to fix file permissions.
• You want to inspect folders inside the container.
• You want to run a command that needs admin rights.
• You want the container to always run as root.

The safest answer is simple. Use temporary root access. Do not turn the container into a tiny SSH server. That is like putting a front door on a toolbox.

Image not found in postmeta

Before you touch root, check your containers

First, go to the folder where your Immich docker-compose.yml file lives. This is often a folder named immich.

cd /path/to/immich
docker compose ps

This shows your running containers. You may see names like:

• immich_server
• immich_machine_learning
• immich_postgres
• immich_redis

Your exact names may differ. That is normal. Docker likes names. Humans like coffee. We all have our hobbies.

Now check which user the Immich server is using:

docker compose exec immich_server sh -c "id && whoami"

If that command works, it will print something like a user ID, group ID, and username. Save that information in your brain for later. Or write it down. Brains are not always reliable after midnight.

Open a temporary root shell

This is the main move. It gives you root access inside the container without changing the container forever.

docker compose exec -u root immich_server sh

If the container has Bash installed, you can try this:

docker compose exec -u root immich_server bash

If Bash is not there, do not panic. Many containers use sh. It is smaller. It is boring. It works.

Once inside, test your powers:

id

If you see uid=0(root), congratulations. You are root. Please do not press random buttons. Root is not a toy sword. It is a chainsaw with Wi-Fi.

Use root for quick fixes only

Root is great for a few tasks. It is not great as a lifestyle.

Good reasons to use root include:

• Checking permissions on upload folders.
• Testing access to mounted storage.
• Changing ownership of files.
• Reading logs or folders blocked from normal users.
• Debugging why Immich cannot import photos.

Bad reasons include:

• Running Immich as root forever “just because.”
• Installing random tools inside the container.
• Adding SSH to the container.
• Changing database files by hand.

Containers are meant to be rebuilt. If you install tools inside one, those changes may disappear later. Poof. Like socks in a dryer.

Fix common Immich permission problems

Many Immich problems happen on the host, not inside the container. The upload library is usually mounted from your server into Docker. For example, your compose file may point to a folder like ./library or /mnt/photos/immich.

Check the folder on the host:

ls -ln ./library

The -n flag shows numeric user IDs and group IDs. That helps because container users may not match host usernames.

If Immich cannot write to the folder, you may need to change ownership. First, check what user Immich runs as:

docker compose exec immich_server id

Then match the host folder to that UID and GID. Here is an example only:

sudo chown -R 1000:1000 ./library

Do not blindly copy 1000:1000. Check your setup first. The right numbers depend on your container and your server.

If you use an external drive, also check mount options. Some drives use NTFS or exFAT. These may need special UID and GID mount options. Permissions can look correct but still refuse writes. Sneaky little goblin behavior.

Run one command as root

You do not always need a full shell. You can run one command as root and leave.

docker compose exec -u root immich_server ls -la /usr/src/app

Or:

docker compose exec -u root immich_server chown -R 1000:1000 /path/inside/container

Again, be careful with chown -R. Recursive commands are powerful. They do not ask, “Are you emotionally ready?”

Use docker exec if compose names are tricky

Sometimes docker compose exec is not convenient. You can use plain Docker instead.

First, find the container name:

docker ps

Then enter as root:

docker exec -it -u 0 container_name sh

The -u 0 part means root. User ID 0 is root in Linux. It is the boss number.

Should you configure Immich to always run as root?

Usually, no. Running services as root increases risk. If the app has a bug, root makes the blast radius bigger. A non-root container is safer.

Still, you may want to temporarily force a service to run as root while repairing a messy setup. You can do this with a small override file.

Create a file named docker-compose.override.yml:

services:
  immich_server:
    user: "0:0"

Then restart:

docker compose up -d

After the repair, remove that override. Then restart again:

docker compose up -d

This method should be temporary. Think of it like borrowing a ladder. Useful. But you do not live on the ladder.

Do not enable SSH root login inside Immich

This is important. Do not install SSH in the Immich container just to log in as root. It adds extra software. It adds extra risk. It also fights the Docker way.

The Docker way is:

• Use docker compose exec for shell access.
• Use volumes for persistent files.
• Use compose files for configuration.
• Rebuild containers instead of hand-editing them forever.

If you need remote access, SSH into the host server. Then run Docker commands from there. That gives you one secure door, not five weird windows.

Quick safety checklist

Before using root, run through this tiny checklist:

• Backup first. Especially your database and library.
• Know the target. Check the container name.
• Check IDs. Use id before changing ownership.
• Avoid random chmod 777. It is not a fix. It is a permission party.
• Make changes on the host when possible. Volumes live there.
• Exit root when done. Type exit and move on.

A simple example

Imagine your phone uploads fail after you moved Immich to a new drive. The app says upload failed. The logs show permission errors. Classic.

You check the Immich user:

docker compose exec immich_server id

You check the host folder:

ls -ln /mnt/photos/immich

The folder belongs to the wrong UID. So you fix it on the host:

sudo chown -R 1000:1000 /mnt/photos/immich

Then restart Immich:

docker compose restart immich_server

Uploads work again. The family photos return. The dog pictures are safe. Peace has been restored to the kingdom.

Final thoughts

Root access in an Immich Docker setup is useful. But it should be quick, careful, and boring. Use docker compose exec -u root when you need it. Avoid SSH inside containers. Avoid running Immich as root forever.

The best setup is simple. Let Immich run normally. Fix permissions on the host. Use root only when needed. Then exit like a responsible wizard.