Set read and write permissions for external libraries for different users of immich

[lysgwl]

I have searched the existing feature requests, both open and closed, to make sure this is not a duplicate request.

• Yes

The feature

The administrator of immich sets up external galleries for different users, hoping that some users can add and delete images, while others only have read permissions. Different permissions can be set for each user.

1. Log in as the immich administrator, enter the system management options, set up an external library "/usr/src/app/external/test1" for user user1, and also set up an external library "/usr/src/app/external/test1" for user user2.
2. You want user 1 to have read-only access to the external image library, and user 2 to have read and write access to the external image library.

Platform

• Server
• Web
• Mobile

[skatsubo]

How about multiple docker volume mounts, with different internal paths per ro/rw and per user?

• /img-ro for readonly access for user 1
• /img-rw for readwrite access for user 2

volumes:
  - ./img:/img-ro:ro
  - ./img:/img-rw:rw

docker exec -ti immich_server bash

# touch /img-ro/ro.txt
touch: cannot touch '/img-ro/ro.txt': Read-only file system

# touch /img-rw/rw.txt

# ls -al /img-r*

/img-ro:
-rw-r--r-- 1 root root      0 Aug 17 15:26 rw.txt

/img-rw:
-rw-r--r-- 1 root root      0 Aug 17 15:26 rw.txt

[lysgwl]

How about multiple docker volume mounts, with different internal paths per ro/rw and per user?

• /img-ro for readonly access for user 1
• /img-rw for readwrite access for user 2

volumes:
  - ./img:/img-ro:ro
  - ./img:/img-rw:rw

docker exec -ti immich_server bash

# touch /img-ro/ro.txt
touch: cannot touch '/img-ro/ro.txt': Read-only file system

# touch /img-rw/rw.txt

# ls -al /img-r*

/img-ro:
-rw-r--r-- 1 root root      0 Aug 17 15:26 rw.txt

/img-rw:
-rw-r--r-- 1 root root      0 Aug 17 15:26 rw.txt

I can't say your method is wrong, but this redundant approach isn't necessarily optimal. Consider the tedious process of repeatedly configuring Docker configurations for multiple repositories, often with multiple configurations for the same repository. I find it more straightforward and convenient to simply add read and write permissions when setting up external repositories. What are your thoughts?

[skatsubo]

more straightforward and convenient to simply add read and write permissions when setting up external repositories

I agree, that's more convenient. Consider the docker-based workaround above as ...workaround 😄

I'm just not sure whether the feature would be approved. From #18502 (comment):

We don't want to have any special cases for external libraries

Hopefully in the future external and internal libraries will be unified and adding more features/flexibility will be possible.

[bo0tzz]

#12614