Run Takeout Photo on a NAS with Docker Compose

What you get

The same app as the desktop version: the Photos timeline, Strava (photos on activities) and Proton Photos sync, served from your NAS and opened in a browser at http://<nas-address>:8080. Everything is processed on the NAS; your photos are never uploaded to our servers.

Plans and account

The same plans and prices as the desktop app. Sign in from Settings → Account in the browser and choose a plan. The NAS counts as one of your account's 2 computers. It needs internet at least once a month to refresh the licence.

Requirements

• Docker Engine with Compose v2.24 or later (Synology Container Manager, Unraid, TrueNAS, or any Linux box).
• x86-64 (amd64) CPU.
• 4 GB RAM free for the container; 8 GB recommended for big libraries.
• Disk for the data folder (thumbnails and indexes, plus about 600 MB for the AI model on first use).
• Optional: an NVIDIA GPU (driver 580 or later, NVIDIA Container Toolkit) with the image ghcr.io/ecyshor/takepho-cuda:latest.

Quick start

Save this as docker-compose.yml on the NAS:

services:
  app:
    image: ghcr.io/ecyshor/takepho:latest
    restart: unless-stopped
    ports:
      - "${TIMELINE_PORT:-8080}:8000"
    volumes:
      - ${TIMELINE_DATA:-timeline-data}:/data
      - ${TIMELINE_MODELS:-timeline-models}:/app/models/clip
      - ${TAKEOUT_DIR:-./takeout}:/takeout:ro
    environment:
      # Require a Google sign-in (recommended, see Security below)
      AUTH_ENABLED: "true"
      AUTH_ALLOWED_EMAILS: "you@gmail.com"
volumes:
  timeline-data: {}
  timeline-models: {}

Then start it and open the app:

docker compose up -d
# open http://<nas-address>:8080 in your browser

Folders

• /data: the library database, thumbnails and indexes. Back this up.
• /app/models/clip: the downloaded AI model. It can be re-downloaded, no backup needed.
• /takeout: your Takeout archives, mounted read-only. On Synology, point TAKEOUT_DIR at for example /volume1/takeout.

Security

Turn on sign-in. Without it, anyone who can reach the port can open your whole library and the Google and Proton accounts you connected. Sign-in is off by default, so on a NAS turn it on even if the NAS is only on your home network. The quick-start file above already does this.

To turn it on, add these two lines under environment: in docker-compose.yml, then run docker compose up -d again:

    environment:
      AUTH_ENABLED: "true"
      AUTH_ALLOWED_EMAILS: "you@gmail.com,partner@gmail.com"

• AUTH_ENABLED makes the app ask for a Google sign-in before it opens.
• AUTH_ALLOWED_EMAILS lists the Google accounts that may sign in. You can separate several with commas or allow a whole domain with @example.com. The first account to sign in becomes the owner. If you leave this empty, whoever signs in first claims the instance, so always set it.
• Optional: AUTH_SESSION_DAYS sets how long a sign-in lasts (default 30 days).

Sign-in works with no Google Cloud setup. It goes through the Takeout Photo sign-in relay, which sends you straight back to a home-network address (a 192.168.x.x IP, a .local name or a Tailscale address). For any other address, it first asks you to confirm.

Even with sign-in on, don't forward the port to the internet. To reach the app from outside your home, use a VPN (Tailscale, WireGuard) or an HTTPS reverse proxy.

Updating and backups

Update with:

docker compose pull && docker compose up -d

For backups, copy the data volume (timeline-data).

Synology, Unraid, TrueNAS

In Synology Container Manager, Unraid or TrueNAS, create a Compose project (or stack) from the file above and start it.

Help

If something does not work, open a support issue with where the app runs, the version, what happened and the steps to reproduce.