Synology’s Package Center covers photos, media, and file sync well, and it stops there. Container Manager (the rebranded Docker package on DSM 7.2) unlocks the whole open-source self-hosting catalogue with less RAM than most first-party Synology apps use for the same job. A DS923+ can happily run seven containers alongside file services once you disable Synology Drive and Moments, which nobody who uses Immich needs anyway.
The seven best Docker containers to run on a Synology NAS below are the ones with the longest track record on DSM, the shortest first-run setup, and the clearest gains over the built-in Synology app. Container Manager on DSM 7.2 handles Docker Compose out of the box, so the config for each is a small YAML file you paste and start.
What to look for in a Synology-friendly Docker container
- Amd64 image with an ARM64 variant for the value-line DS units.
- Bind mounts onto a Synology shared folder, so backups still go through Hyper Backup.
- A permission model that plays nicely with
PUID/PGIDset to your Synology user. - Low memory footprint on models with 2–4 GB of RAM.
- A first-run wizard or a well-known reverse-proxy configuration.
- Active development, because DSM will keep changing under it.
Quick comparison table
| App | Best for | Platforms | Free plan | Starting price/mo | Rating |
|---|---|---|---|---|---|
| Portainer | Container management UI | Docker | Community free | $18/node BE | The default Docker UI |
| Immich | Google Photos replacement | Docker | Fully free (OSS) | Free | Widely recommended |
| Jellyfin | Media server without Plex | Docker | Fully free (OSS) | Free | Best free media server |
| Homepage | Dashboard for services | Docker | Fully free (OSS) | Free | Loved for its polish |
| Pi-hole | Network-wide ad and tracker blocking | Docker | Fully free (OSS) | Free | Household staple |
| Vaultwarden | Bitwarden-compatible password server | Docker | Fully free (OSS) | Free | Best self-hosted password manager |
| Paperless-ngx | Document archive with OCR | Docker | Fully free (OSS) | Free | Excellent for scans |
The apps
1. Portainer – best container management UI
Portainer turns Container Manager’s basic UI into a real Docker dashboard: environment variables, restart policies, network editing, live logs, and console access, all in a browser tab. If you plan to run more than three containers on your NAS, install Portainer first.
Where it falls short: Business Edition adds RBAC and multi-cluster; the free Community Edition covers one Docker host well. Container Manager can still get confused about who is orchestrating what if you mix Portainer and DSM UI edits.
Pricing:
- Free: Community Edition, unlimited containers.
- Paid: Business Edition at $18/node/month.
Platforms: Docker (Synology Container Manager).
Download: Portainer.io
Bottom line: Portainer is the shell around every other container on this list.
2. Immich – best Google Photos replacement
Immich is the self-hosted photo library that finally feels like Google Photos. Mobile apps for iOS and Android auto-upload the camera roll, face recognition runs on-device (or on the NAS GPU if you have one), and shared albums work across accounts. Runs comfortably on a Synology Plus-series with Docker.
Where it falls short: Face recognition on CPU is slow for large libraries (10k+ photos) on older DS units. AI model updates occasionally need a re-init step.
Pricing:
- Free (AGPL). Optional paid support at immich.app.
Platforms: Docker.
Download: Immich.app
Bottom line: If Synology Photos is why you keep paying Google, replace both with Immich.
3. Jellyfin – best media server without Plex
Jellyfin is the fully open-source media server that has caught up with Plex on the DSM front. Hardware transcoding works on any Synology model with Intel QuickSync (the Plus-series x86 boxes), and the mobile and TV apps are close to Plex’s polish now.
Where it falls short: No first-party remote-access relay. If you want to stream outside your LAN, you need Tailscale or a reverse proxy. Metadata scraping occasionally misses; manual fixes are quick.
Pricing:
- Free (GPL).
Platforms: Docker; native clients on every major TV and phone platform.
Download: Jellyfin.org
Bottom line: Jellyfin is the “own your media” pick with no paywalls behind any feature.
4. Homepage – best dashboard for services
Homepage is the start page every home lab settles on. YAML-driven config for services, live widgets that pull uptime and status from the containers you already run (Portainer, Immich, Jellyfin, Home Assistant, and dozens more), and a search bar that hits DuckDuckGo, Google, or your own SearXNG.
Where it falls short: No login screen out of the box; put it behind your reverse proxy if the NAS is exposed. Widget errors need a container restart to clear cleanly.
Pricing:
- Free (GPL).
Platforms: Docker.
Download: gethomepage.dev
Bottom line: Homepage is the browser bookmark that replaces “which port was Jellyfin on again?”
5. Pi-hole – best network-wide ad blocker
Pi-hole blocks ads and trackers at the DNS layer for every device on the LAN, including smart TVs and consoles that browser extensions cannot touch. Runs happily in a Docker container on the Synology, listens on the standard DNS ports, and reports which client asked for which domain.
Where it falls short: Container Manager needs the DNS ports mapped explicitly (53/tcp and 53/udp) and Synology’s own DNS service (if enabled) has to move. Not a full firewall.
Pricing:
- Free (EUPL).
Platforms: Docker.
Download: Pi-hole.net
Bottom line: Pi-hole is the container everyone in the house benefits from without knowing you installed it.
6. Vaultwarden – best self-hosted password manager
Vaultwarden is a Bitwarden-compatible server written in Rust that fits under 50 MB of RAM. Bitwarden desktop, browser, and mobile clients connect to it exactly as they connect to the official service. You own the vault; sync between devices happens over your LAN or through your own reverse proxy.
Where it falls short: Backups are your job. A single corrupted volume without a Hyper Backup snapshot means starting over.
Pricing:
- Free (GPL).
Platforms: Docker.
Download: Vaultwarden GitHub
Bottom line: Vaultwarden is the “stop paying for a password manager” move for anyone with a Synology already running.
7. Paperless-ngx – best document archive with OCR
Paperless-ngx takes anything you scan or drop into a watch folder, runs OCR, tags it, and files it into an archive with a search that actually works. Pair it with the Synology-attached scanner (many recent DS models expose one via USB) and every receipt, contract, and manual is one search away instead of stacked in the physical filing cabinet.
Where it falls short: First-run OCR on a large backlog will pin a Synology CPU for hours. Frontend is functional, not fancy.
Pricing:
- Free (GPL).
Platforms: Docker.
Download: Paperless-ngx docs
Bottom line: Paperless-ngx is the “no more physical filing cabinet” upgrade that will save you a Sunday every year.
How to pick the right one
- If you have not run Docker before, start with Portainer. Everything else assumes it.
- If your reason to buy the Synology was photos, replace Synology Photos with Immich.
- If your reason was media, replace Plex with Jellyfin.
- If you want one page to see everything, Homepage.
- If the household hates ads, Pi-hole.
- If you are paying for 1Password or Bitwarden, Vaultwarden pays for the NAS in a year.
- If the physical filing cabinet is a problem, Paperless-ngx.
You can run all seven on a DS920+ or better. On a 2-bay value-line unit, pick three; the RAM ceiling bites at four.
FAQ
Do I need to disable Synology packages before installing these containers?
Only when the container replaces a package (Immich vs Synology Photos, Jellyfin vs Video Station, Pi-hole vs Synology DNS Server). Leaving both running works but wastes RAM and confuses backups.
Where should I store container data on a Synology NAS?
Create a shared folder called docker and bind-mount container volumes into subfolders. That keeps Hyper Backup working and matches every tutorial you will find. Do not use /volume1/@docker/ directly; that path is a moving target across DSM updates.
Can I run these containers on an ARM Synology NAS?
Most, yes. Immich, Jellyfin, Homepage, Pi-hole, Vaultwarden, and Paperless-ngx all publish ARM64 images. Portainer does too. A handful of niche containers are amd64-only; check the image tag before pulling.
What is the biggest self-hosted container that runs on a Synology NAS?
Immich is the heaviest of these seven because of its machine-learning image tagging. It fits on a DS920+ with 8 GB of RAM alongside a couple of other containers. Nextcloud (not on this list) is similar. Anything AI-heavy needs an x86 Plus-series box.
How do I keep Docker containers on a Synology up to date?
Container Manager can auto-pull latest images and recreate containers on a schedule. Portainer has the same option under Stacks. For finer control, add Watchtower (an eighth container) and let it prune old images too.
