Self-hosted media server setup, configuration, and maintenance notes.
A simple Proxmox → LXC → Jellyfin stack keeps components isolated while mounting media from the host. This approach minimizes risk and makes the container easy to rebuild without touching data.
This design avoids nested storage complexity and keeps the container disposable. It isolates Jellyfin while keeping media management on the host for safety.
LXC suits single-purpose services like Jellyfin thanks to low overhead and fast boot. Using an unprivileged container further reduces risk by mapping IDs rather than granting direct host access.
An unprivileged container is used to reduce risk. UID/GID mapping ensures the container cannot directly access host resources unless explicitly allowed.
Provision a lightweight container with enough CPU/RAM to serve streams and handle metadata. Keep the root disk small and treat the container as disposable—your media stays on the host.
Debian is chosen for stability and predictable package behaviour. It keeps upgrades consistent and reduces surprises during long-term operation.
Update packages and install base tools so the environment is consistent and secure. This prevents install issues and ensures TLS/cert utilities behave correctly.
After first boot:
apt update && apt upgrade -y
apt install -y curl gnupg2 ca-certificates lsb-release
This ensures the system is fully patched before installing Jellyfin. It also provides the tools needed for repository setup and secure downloads.
Enable the official Jellyfin repository to get trusted, up-to-date packages. Install the service and confirm it starts on port 8096 for local access.
Add the official Jellyfin repository:
curl -fsSL https://repo.jellyfin.org/install-debuntu.sh | bash
Install Jellyfin:
apt install -y jellyfin
The service starts automatically and listens on port 8096.
Keep media on the host and mount it into the container via bind mounts to keep the container stateless. This simplifies backups and lets you rebuild Jellyfin without touching data.
Media is stored on the Proxmox host and exposed to the container using bind mounts.
Example host paths:
Bind mount configuration in Proxmox:
mp0: /tank/media,mp=/media
Inside the container, Jellyfin sees all media under /media.
If your media lives on a NAS, mount it on the Proxmox host and bind that path into the Jellyfin LXC. Prefer NFS on Linux for performance; SMB works well with Windows/Samba shares.
nas.example.local:/export/media /mnt/nas/media nfs4 \
rw,noatime,_netdev,hard,intr 0 0
Note: In /etc/fstab this should be a single line. Remove the line breaks and backslashes when pasting.
Mount on the host, then bind into the container (Proxmox): mp0: /mnt/nas/media,mp=/media or via CLI: pct set <CTID> -mp0 /mnt/nas/media,mp=/media.
//nas.example.local/media /mnt/nas/media cifs \
credentials=/root/.smbcredentials,iocharset=utf8,vers=3.1.1, \
_netdev,nofail,dir_mode=0755,file_mode=0644 0 0
Note: In /etc/fstab this should be a single line. Remove the line breaks and backslashes when pasting.
Bind mount into the container the same way as NFS. Ensure the share is readable from an unprivileged LXC (see Permissions).
Ensure file ownership and permissions align across host and container so Jellyfin can read media reliably. Misaligned UID/GID mappings are the most common cause of access errors.
Jellyfin runs as the jellyfin user. Ensure UID/GID alignment:
chown -R jellyfin:jellyfin /media
chmod -R 755 /media
If the host uses different IDs, adjust using Proxmox ID mapping or ACLs.
Walk through the first-run wizard to set admin credentials and add libraries from your mounted paths. Configure language, metadata preferences, and network exposure to fit your environment.
Access the web UI:
http://<container-ip>:8096
Configuration steps:
Favor portable metadata stored alongside your media so libraries survive container rebuilds. Local artwork and NFO files reduce rescans and keep matches accurate.
Recommended settings:
This keeps metadata portable and version-controlled if needed.
Hardware acceleration offloads video processing to the iGPU, enabling more concurrent streams with lower CPU usage. Pass through the device and enable VAAPI to take advantage of it.
If using Intel iGPU:
This significantly reduces CPU usage during streaming.
Choose how clients reach Jellyfin—direct LAN, reverse proxy, or VPN—based on your security model. Any public exposure must use HTTPS and sensible headers.
Common access patterns:
For public exposure, HTTPS is mandatory.
Back up Jellyfin config and portable metadata so you can recreate containers quickly. Keep the OS patched and Jellyfin updated to maintain performance and security.
Recommended backups:
Updates:
apt update && apt upgrade -y
Treat the container as stateless and focus on clean mounts from the host. Rebuilds and upgrades should be routine tasks that never endanger your media library.
This setup scales cleanly and remains easy to reason about months later.