How to update Jellyfin / Plex LXC to unprivileged?

[hoggatt]

I noticed recently that the scripts for jellyfin and plex have been updated to be unprivileged by default. I'd love to make Jellyfin unprivileged since it is my only privileged container. The update script does not naturally make this change, so I'm wondering if the process would be simple or not?

[JakePi3]

You have to backup and restore the instance. You can select unprivileged during the restore.

Just be aware of the additional gid/uid mappings you may need for mapping host hardware (if you use hardware accelerated transcoding).. Basically, unprivileged containers add 100000 to the uid.. You can reverse this in the lxc conf file.. it's really the only thing that complicates unprivileged setup. There are youtube videos online of how to do this.

[tteck]

With the new LXC device passthrough, YouTube videos are pretty useless at this point.

[tteck]

@hoggatt It would be best to create a new unprivileged Jellyfin LXC to ensure correct group settings.

edit: And correct unprivileged Hardware Acceleration Support.

[Masked-Kunsiquat]

@tteck hi there! if I make a new LXC for jellyfin, which directories should I backup from the original?
I wanna take advantage of this unprivileged setup and ideally preserve my user data (history, playlists, etc).

thanks in advance!

[hoggatt]

Doesn't seem like it's really supported in a clean way right now: https://forum.jellyfin.org/t-jellyfin-backups-migration

[Masked-Kunsiquat]

just an update, I successfully transferred over to a new LXC.

What I Did:

• copied the /var/lib/jellyfin directories
• copied my MAC address from the original LXC (since I'm too lazy to mess with my reverse proxy)
• used that MAC address when using @tteck 's updated script
• shutdown the jellyfin service in the new LXC (systemctl stop jellyfin)
• replace the /var/lib/jellyfin directory with the one from the original LXC (I used scp from an intermediate laptop)
• fix the permissions to the jellyfin user/group
• start back up jellyfin (systemctl start jellyfin) on the new LXC
• then I mounted my NAS folder to proxmox, and created a mountpoint in the LXC (from guides online)

Questions:

Are there any negatives I should look out for?

And I'm not a coder... could that plex copy script be modified to do something similar? (minus the mount part)

[namadori]

@Masked-Kunsiquat I tried this process, when accessing the new LXC I was prompted to create a new user.

The solution was to edit the file /etc/jellyfin/system.xml changing <IsStartupWizardCompleted> from false to true

[Masked-Kunsiquat]

The solution was to edit the file /etc/jellyfin/system.xml changing <IsStartupWizardCompleted> from false to true

@namadori hey, if that worked for you, go for it! I personally didn't have to mess with that file.

@Masked-Kunsiquat I tried this process, when accessing the new LXC I was prompted to create a new user.

I did run into that issue. I was able to circumvent it by doing the steps exactly as I listed. by stopping the service, and replacing the entire directory from your source LXC, before starting the service back up.
As soon as I did that, I was returned to my home screen (still signed in in-fact, since I didn't clear cookies).

I'm assuming your way is the more official way though! 🤷🏾‍♂️

[namadori]

I tried to setup a new unprivileged LXC, but now I found I can't mount the NFS share with the media files.
I've read that one solution is to mount the NFS on the Proxmox host and then Bind Mount to the container, but I don't like the idea of changing the host configuration this way.

What's the best course of action?

[condio]

I'll be honest. I just did this and couldn't find anything less invasive than the bind mounts. You don't have to do what I did, but I did want to share since I really struggled after converting to unprivilaged, and I wanted to make sure I documented how I was successful to anyone else struggling.

I used the shell to make a new folder under /media.
mkdir /media/mymedia

Then I did a temp NFS mount to see if this would work by entering
mount -t nfs YourNASIPHere:/volume1/plexmedia /media/mymedia

I was able to cd into the folder on my proxmox and see all my data, so I knew it worked.

Next I unmounted the drive.
umount /media/mymedia

Then I setup a permanent mount that would connect on a reboot by editing the fstab.
nano /etc/fstab
then add the line
EnterYourNASIP:/volume1/plexmedia /media/mymedia nfs defaults 0 0
Obviously make sure you pick the right source path to your media.

Then to make the mount take effect without a system reboot, I had to run:
systemctl daemon-reload
mount -a

Then it's pretty each to bindmount the data into your LXC by ensurring the LXC is shutdown and then running the following command from shell:
pct set 111 -mp0 /media/mymedia,mp=/media/mymedia
111 is my container ID, so please use yours.

After this, you can boot up the LXC and you'll have read access to all of your media. To get write access, I just had to make changes on my Synology server's NFS settings. You may not need/want write access.

This took me a few hours to get this setup because I had never mounted in linux before, I was reading all kinds of reddit/google threads, and I wasn't sure how bind mounts would work. The above is what I found successful and I've replicated it a few times since with other LXCs like Emby.