That said, this is far better than my own non-existent image server.
For me a measure of quality is the rendered HTML code, which should use all the content sectioning elements and not be bloated with gazillions of divs and classes. This software is well off the pace in this regard.
On the flip side, the rapid pace also shows there’s a lot of active development and bug fixing going on. Personally, I tend to wait until something gets packaged in Debian/Ubuntu too, because it means the maintainers have stabilized the dependency tree enough that distro maintainers trust it. Until then, I’ll usually sandbox it with Docker just to play around, but I wouldn’t put it in a “set it and forget it” deployment.
Curious though do you think a “long-term support” branch for projects like this would actually solve the problem, or would the underlying ecosystem still move too fast?
and if you're serious, k8s config. otherwise don't waste my time.
A stable release is only a couple months out. Maybe do a Takeout until then, and put it in S3 Glacier, or similar?
> Debian isn't immune to this, but it's much harder for such an attack to be successful when dependencies aren't constantly changing.
Immich is more immune to this issue because they wait 5 days before raising PRs to bump dependencies, which is a good practice https://github.com/immich-app/.github/blob/main/renovate-con...
Also, Docker-compose is pretty great in terms of getting complex applications up and running.
Immich is an excellent piece of software, I have switch all my photo needs from over 25 years to it. It will mature and it actually already is. Don't hold yourself back with such practicalities.
I'm keen to use it as soon as the dependency story is mature (eg. it is packaged in Debian). This doesn't seem likely to happen any time soon.
I'm sure many people won't care about this. But for me, it's a measure of quality. I expect to be able to deploy and not worry about it, except for security updates, for at least a couple of years, preferably more. Constantly moving dependencies spidering out to a multitude of other projects, and Docker Compose, provide no such confidence.
Edit:
Ironically, just after posting that I came across this, which I think proves why my concern is warranted: https://news.ycombinator.com/item?id=45169657
Debian isn't immune to this, but it's much harder for such an attack to be successful when dependencies aren't constantly changing.