Change user used by Jellyfin

[SilverHazeLazers]

First a big thanks to tteck! These scripts have helped me learn so much about proxmox

I am setting up Jellyfin (along with Solarr, Radarr etc) as separate LXCs. To allow access to storage on the host I am doing a bind mount (/mnt/media). My research suggests creating the same user UID/GID (media/media 1001/1001) on the host and LXCs simplifies permissions. The approach is described here under 'Method 2' if anyone is interested

So my question, how would I go about updating the Jellyfin LXC to run Jellyfin using the user I have created? I believe, by default, the user running the app in the LXC is root

Thanks in advance

[SilverHazeLazers]

Thanks for moving to 'Discussions' @tteck and apologies, I wasnt aware of this Github feature

[schiz0phr3ne]

You need to change the user in /lib/systemd/system/jellyfin.service :

[Unit]
Description = Jellyfin Media Server
After = network.target

[Service]
Type = simple
EnvironmentFile = /etc/default/jellyfin
User = <your user>
ExecStart = /usr/bin/jellyfin ${JELLYFIN_WEB_OPT} ${JELLYFIN_RESTART_OPT} ${JELLYFIN_FFMPEG_OPT} ${JELL>
Restart = on-failure
TimeoutSec = 15

[Install]
WantedBy = multi-user.target

Better but need to try, is to create /lib/systemd/system/jellyfin.service.d/ folder and /lib/systemd/system/jellyfin.service.d/override.conf file inside, with these only 2 lines :

[Service]
User = <your user>

After that, you need to change owner of Jellyfin files and folders (or you can add you user to root group for example, but this is not recommended. Or chmod to permit your user to use them). Here with jellyfin as user and group :

root@jellyfin:~# chown -R jellyfin:jellyfin /etc/default/jellyfin
root@jellyfin:~# chown -R jellyfin:jellyfin /usr/bin/jellyfin
root@jellyfin:~# chown -R jellyfin:jellyfin /var/lib/jellyfin/
root@jellyfin:~# chown -R jellyfin:jellyfin /etc/jellyfin/
root@jellyfin:~# chown -R jellyfin:jellyfin /var/log/jellyfin/
root@jellyfin:~# chown -R jellyfin:jellyfin /var/cache/jellyfin/
root@jellyfin:~# chown -R jellyfin:jellyfin /usr/share/jellyfin
root@jellyfin:~# chown -R jellyfin:jellyfin /usr/share/jellyfin-ffmpeg
root@jellyfin:~# chown -R jellyfin:jellyfin /usr/lib/jellyfin/
root@jellyfin:~# chown -R jellyfin:jellyfin /usr/lib/jellyfin-ffmpeg/

After that, you need to reload systemd with changes made at step 1 :

root@jellyfin:~# systemctl daemon-reload

and restart service :

root@jellyfin:~# systemctl restart jellyfin

Yiu can no check that your user is running Jellyfin :

root@jellyfin:~# ps -aux
USER         PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
...
jellyfin     149  0.0  9.4 3676716 198456 ?      Ssl  10:51   0:03 /usr/bin/jellyfin --webdir=/usr/share/jellyfin/web --restartpath=/usr/lib/jellyfin/restart.sh --
...

[SilverHazeLazers]

@schiz0phr3ne Thank you so much for the detailed reply and apologies on the late reply from my side.

I have attempted the suggested steps a couple of times to no avail - although I think the problem might be between the keyboard and chair (i.e. me).

After making the changes, when I reboot the LXC I get automatic login failed. My theory is that I will need to also update the auto logged in user for the LXC which I will try and work out how to do this weekend and report back

Just in case it is relevant, here is my xxx.conf mapping on the host, the user on host and LXC is 1001:1001

lxc.idmap = u 0 100000 1001 
lxc.idmap = g 0 100000 1001 
lxc.idmap = u 1001 1001 1 
lxc.idmap = g 1001 1001 1 
lxc.idmap = u 1002 101001 64534 
lxc.idmap = g 1002 101001 64534

[sandreas]

@SilverHazeLazers Did you solve this? I'm running into the same problem.

[SilverHazeLazers]

@sandreas Unfortunately not - I ended up going with a privileged ubuntu LXC to get around the issues I was having. Likewise for all the *arr suite. I might give it another go over xmas and will report back if I have success. Still holding out hope that tteck might come to the rescue with one of his install scripts

[sandreas]

@SilverHazeLazers Thanks for the quick reply. Well, I think that I have to take care of this someday :-) I don't like running privileged containers... there must be a way to do this.

[SilverHazeLazers]

@sandreas Sorry I couldnt be of more help - the privileged LXC thing bugs me as well.

Just in case it's helpful, here are the steps I had saved:

1. Create the unprivileged ubuntu LXC
2. On the PVE host, create the shared directory ( maybe using subdirectories to hide sonar/deluge workdir
3. Bind mount the "shared" directory in all the containers by going to go to /etc/pve/lxc/<ctid>.conf and add the following line: mp0: /mnt/media,mp=/mnt/media
4. Create a user 'media' and user group 'media' adduser -uid 1001 media
5. Add the user to media group usermod -aG media media
6. Check the user UID/GID less /etc/passwd
7. Give the user ownership of the media folder using UID/GID (e.g 1001/1001) chown 1001:1001 /mnt/media -R
8. Check permissions with stat /path/to/file
9. Permit the LXC daemon to use our desired uid/gid on the host echo "root:1001:1" >> /etc/subuid and echo "root:1001:1" >> /etc/subgid
10. Add the custom mapping to each containers config, go to /etc/pve/lxc/<ctid>.conf and add:

lxc.idmap = g 0 100000 1001
lxc.idmap = u 1001 1001 1
lxc.idmap = g 1001 1001 1
lxc.idmap = u 1002 101001 64534
lxc.idmap = g 102 101001 64534

11. In the LXC, adduser --uid 1001 --gid 1001 media
12. Make each program run using that user/group so they have permission for the share. Details on this above - you'll need to chown all the relevant files and add the override to jellyfin.service.d

[reebevoli]

I'm struggling here as well....

I've created a folder on the host and mounted it in each container (for example, mp0: /mnt/downloads,mp=/mnt/downloads). My Radarr, Sonarr, Sabnzbd containers can all see the mounted folder but they all have UID/GID of Nobody/Nogroup and I can not figure out how to fix it.

I've tried following the following, but no luck.

• https://pve.proxmox.com/wiki/Unprivileged_LXC_containers
• https://github.com/vzamora/Proxmox-Cheatsheet/blob/main/General%20Proxmox%20Setup%20and%20Notes/ZFS%20Info.md
• https://www.reddit.com/r/Proxmox/comments/gmowvp/how_to_create_shared_storage_for/

Again, my knowledge is limited but I think ideally each container would have it's own user "radarr", "sonarr", "sabnzbd", "plex" whom are all part of the group "media" and then apply these permissions to the mounted folders on the host.

If anyone has figured this out, I would greatly appreciate the help.

Cheers.

[ab-c-def]

Hi, I had the same issues as listed above with my unprivileged LXC containers. I found the following post and followed the advice which resolved my permissions issues. Hopefully this helps others as well.

https://forum.proxmox.com/threads/lxc-user-mapping-permission-problem.108244/