Set the Immich instance to run as the UID that owns the media files?

I can only think of two ways if the top of my head:

• Immich runs as root and sets ownership (sounds unsafe)
• Immich is the owner of all the files, but each user has a specific group (bobs-photos) of which Immich and the user are members. Then use the setgid bit to set group ownership and make it g+rwx.

Both sound pretty brittle to me, though, and I haven’t tested this specifically.

You can configure samba to handle the permissions, but immich will need to connect to the user’s share using their password (no ideal)

In smb.conf for each user’s share

[user_media]
   path = /path/to/user/media
   valid users = username, immich
   force user = username  # This makes all files.  appear as owned by the user
   force group = media
   create mask = 0660
   directory mask = 0770

Alternatively you can use setguid with your media group:

chmod g+s /path/to/media/dirs
chown -R :media /path/to/media/dirs
chmod 2770 /path/to/media/dirs. (2 = SetGID, 770 = rwx for user and group)

• Any new file created by Immich will automatically belong to the media group
• The SetGID bit ensures files inherit the parent directory’s group
• All users (including Immich) can read/write files as long as they’re in the media group
• Individual users still “own” their files (UID stays as the original user when they upload via Samba)

Generally, accessing files both as a share and through an app is not well supported. If Immich doesn’t support setting ownership, you might be able to patch it to add the feature.

Otherwise, I’d probably stick to the user-group model you have currently, and do the chown/chmod. Immich should be able to fully manage files as long as it has the group permissions necessary (g+rw).

Preface

I got excited and didn’t properly read your post before I wrote out a huge reply. I thought your problem was the per-user mapping to different locations on your NAS or to different shares, but its specifically file ownership.
whoops.

Leaving this here anyways, in case someone finds it helpful.
I kinda address file ownership at the end, but I don’t think its really what you were looking for because it depends on every user having their own share.

Prerequisites

1. you need to be using Storage Templates.
2. you’re willing to change the storage labels for all existing users
   • if not, then change the storage labels for all users to something temporary and run the migration job before you begin. You’ll change it back later.
3. you’re willing to switch to NFS instead of samba, where each user gets their own share.
   • might not actually be necessary, but its what I use, so YMMV

Configuration

Volumes

In docker, you’ll need to set up an external NFS volume for every user. I use portainer to manage my docker stacks, and its pretty easy to set up NFS volumes. I’m not sure how to do it with raw docker, but I dont think its complicated.

Compose

in your docker compose files, include something like this

services:
  immich-server:
    # ...
    volumes:
      - ${UPLOAD_LOCATION}:/data
      - /etc/localtime:/etc/localtime:ro
     - type: volume
        source: user1-share
        target: /data/library/user1-intended-storage-label
        volume:
          subpath: path/to/photos/in/user1/share
    - type: volume
        source: user2-share
        target: /data/library/user2-intended-storage-label
        volume:
          subpath: path/to/photos/in/user2/share
    # and so on for every user
  # ...

volumes:
  model-cache:
  user1-share:
    external: true
  user2-share

Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:

3 acronyms in this thread; the most compressed thread commented on today has 6 acronyms.

[Thread #1013 for this comm, first seen 21st Jan 2026, 05:05] [FAQ] [Full list] [Contact] [Source code]

There probably is a clever way that you could do it, but clever ways are easy to overstep, misconfigure and can be unreliable long-term.