Install without Docker

[rstemmer]

Hi,

I'm thinking of using PhotoPrism to complement my NextCloud setup with more advanced photo management. The documented WebDAV interface seems to be exact what I need to do this.

But I cannot find any instructions how to install PhotoPrism itself. All I can find is the instruction to run it with Docker which is not an option for me.

Question: Is there an instruction to install PhotoPrism without using Docker?

kind regards,
Ralf

[lastzero]

We don't maintain RPM/DEB/MacOS packages yet due to a lack of resources. As a developer, you can build PhotoPrism without Docker if you manually run the instructions in our Dockerfile(s):

• https://github.com/photoprism/photoprism/blob/develop/docker/development/Dockerfile
• https://github.com/photoprism/photoprism/blob/develop/docker/photoprism/Dockerfile

Note that running server applications is generally safer within a container, especially if they are able to process a long list of file formats (same reason virus scanners are a prime attack vector). Docker is just one solution for this. You could also use Solaris Zones, BSD Jails, and VMs. That is because most parsers are written in C, and they historically contain a ton of bugs (like buffer overflows) that won't go away for the next 10 years. So it's better not to give them full access to your system if possible. In addition, our Docker images are updated frequently and may come with security fixes that are not part of the standard Ubuntu distribution, for example https://ubuntu.com/security/CVE-2021-22204.

[rstemmer]

I've a different opinion on the security aspect.
Updating docker containers is a pain because it is not done by the systems package manager. There is no automation behind the updating process. If I have to manually look for updates, download and apply the updates for several containers, I will never update a single one 😀
Just an example: As you mentioned, the container comes with Ubuntu 21.04 which uses ffmpeg 4.3. On my system, the ffmpeg version is 4.4 which comes with several fixes. At this point, the container violates my security concept of always having the latest version of libraries and tools. And this is one of the reasons why Docker is no option for me 😉
Additionally I have no control of the configurations of system components within the container (Well, I have, but they will be overwritten with the next update of the container).
I also see no advances in a container being hacked, containing a full operating system I have not under control, compared to the host operating system being hacked. Especially because I have no simple way to monitor what's going on inside the containers operating system.
When using containers, I not maintain just a single Server, I have to maintain a lot of servers, all coming with different operating systems and setups. This makes it impossible to keep them all secure 😀

Anyway. Your answer helped me a lot. 👍
Thank you very much.

[lastzero]

Aware of the tradeoffs. We're building frequently, so packages are mostly up-to-date if not newer than what distributions provide. In addition, you don't need to be an expert on the configuration of all those dependencies and there are no version conflicts with already installed packages. Of note is TensorFlow, where we have to use an older self-compiled version as the current version is broken for our use case (but included in many distributions): #222 (comment)

Since it's a standard Ubuntu base image, you can simply run apt update / upgrade within the container to keep packages updated, like you would do on your host. There is a package manager just as well.

On ffmpeg: Would be surprised if Ubuntu upgrades ffmpeg 4.3 to 4.4 within the same release. Seems you're using an external package. Did you check it supports the exact same codecs and hardware the original Ubuntu package supports? Changing package providers and versions requires testing and may have other drawbacks. I'm 100% sure even your updated ffmpeg version contains a ton of security issues and bugs. You're not protected and should use a container just as well.

Bottom line: If you're an expert and you always have the latest dependencies installed anyway, it's probably best for you to build from source. This may also require building TensorFlow from source, which took me 7 days and nights last time. Know what you're getting yourself into.

[rstemmer]

You are addressing the issue I have with Containers even better that I did explain 😃
When using Docker, I not only have to pacman -Syu my own system, but also to apt update && apt upgrade (and similar steps with other package managers) inside all containers which makes maintenance impossible. (Or I have to rebuilt new containers from updated images I have too look for myself)

Of cause building and/or installing software on Linux is a pain when it's not provided by the package manager.
I prefer "hard to install" over "hard to maintain" 😁

[lastzero]

Watchtower automatically fetches updated images so you don't have to keep them updated manually (similar to a package manager):

https://docs.photoprism.org/getting-started/updates/#watchtower

IMHO the security of file parsers is beyond repair even with the latest fixes. So it's a prime use case for containers. I see you have a background in computer science - most users don't and are not experts for dependency management and kernel security. You probably don't want us to outsource all responsibility to them either.

Note the chroot system call dates back to 1979. We've always used it where appropriate.