Immich Machine Learning (ghcr.io/immich-app/immich-machine-learning:v3) uses a library called ONNX Runtime, from Microsoft.

This library has telemetry enabled by default, and the Docker build of Immich Machine Learning does not disable it.

I found out about this because my DNS logs were showing thousands and thousands of blocked queries to resolve mobile.events.data.microsoft.com.

I don't think this is acceptable for something that is going to process all my photos, especially since it goes to Microsoft, even if it's anonymised or whatever. The whole point of self hosting is avoiding shit like this.

Mitigations:

Add the environment variable ORT_DISABLE_TELEMETRY=1 to the immich-machine-learning container.

Aditionally, it is good practice to isolate all containers that do not need internet access from the internet. For example, with Docker compose, you can create an isolated network for Immich:

networks: immich-iso: internal: true driver: bridge 

Then, on all immich containers:

networks: - immich-iso 

Be sure to add your reverse proxy to this network so that it can access the Immich server.

This was reported to the Immich issue tracker in August and they have not addressed it yet.