[Issue]: Docker Container Missing Jellyfin User

backuprepo commented

2025-12-22 01:51:14 +01:00

Owner

Originally created by @polskikrol on GitHub (Mar 6, 2024).

Please describe your bug

Trying to secure the Jellyfin docker container. I am not setting privileged mode, and setting PUID and GUID environment variables. When I run the container as root, everything works as needed and I am able to access the render device:

/usr/lib/jellyfin-ffmpeg/vainfo --display drm --device /dev/dri/renderD128

However, when I set the 'user: x:x' option in the docker-compose.yml file and rebuild the container, there are issues. The jellyfin user and group does not exist.

Now.... does Jellyfin docker support running as non-root? Is there a set of documented environment variables and perhaps I am not passing the correct one? Is there an initial startup script that has issues or doesnt currently create the required user / group?

Reproduction Steps

Please see description.

Jellyfin Version

10.8.13

if other:

No response

Environment

- OS:
- Linux Kernel:
- Virtualization:
- Clients:
- Browser:
- FFmpeg Version:
- Playback Method:
- Hardware Acceleration:
- GPU Model:
- Plugins:
- Reverse Proxy:
- Base URL:
- Networking:
- Storage:

Jellyfin logs

N/A

FFmpeg logs

No response

Please attach any browser or client logs here

No response

Please attach any screenshots here

No response

Code of Conduct

I agree to follow this project's Code of Conduct

Originally created by @polskikrol on GitHub (Mar 6, 2024). ### Please describe your bug Trying to secure the Jellyfin docker container. I am *not* setting privileged mode, and setting PUID and GUID environment variables. When I run the container as root, everything works as needed and I am able to access the render device: `/usr/lib/jellyfin-ffmpeg/vainfo --display drm --device /dev/dri/renderD128` However, when I set the 'user: x:x' option in the docker-compose.yml file and rebuild the container, there are issues. The jellyfin user and group does not exist. Now.... does Jellyfin docker support running as non-root? Is there a set of documented environment variables and perhaps I am not passing the correct one? Is there an initial startup script that has issues or doesnt currently create the required user / group? ### Reproduction Steps Please see description. ### Jellyfin Version 10.8.13 ### if other: _No response_ ### Environment ```markdown - OS: - Linux Kernel: - Virtualization: - Clients: - Browser: - FFmpeg Version: - Playback Method: - Hardware Acceleration: - GPU Model: - Plugins: - Reverse Proxy: - Base URL: - Networking: - Storage: ``` ### Jellyfin logs ```shell N/A ``` ### FFmpeg logs _No response_ ### Please attach any browser or client logs here _No response_ ### Please attach any screenshots here _No response_ ### Code of Conduct - [X] I agree to follow this project's Code of Conduct

backuprepo

2025-12-22 01:51:14 +01:00

closed this issue
added the
bug

downstream
labels

backuprepo commented

2025-12-22 01:51:18 +01:00

Author

Owner

@TimGels commented on GitHub (Mar 6, 2024):

Please fill in the whole template next time. Currently, I am guessing you are using the third party unofficial linux server io jellyfin container image by you using the words GUID and PUID.

I use the official container, but I don't think permission wise there is a difference (I am only familiar with the official one however). I do not run my docker instance as root. Make sure the uid:gid are set up correctly permission wise on the host.

@TimGels commented on GitHub (Mar 6, 2024): Please fill in the whole template next time. Currently, I am guessing you are using the third party unofficial linux server io jellyfin container image by you using the words GUID and PUID. I use the official container, but I don't think permission wise there is a difference (I am only familiar with the official one however). I do not run my docker instance as root. Make sure the uid:gid are set up correctly permission wise on the host.

backuprepo commented

2025-12-22 01:51:21 +01:00

Author

Owner

@polskikrol commented on GitHub (Mar 6, 2024):

I believe to be using the correct image:

version: '3.8'
services:
  jellyfin:
    image: 'jellyfin/jellyfin:latest'
    container_name: 'jellyfin'
    hostname: 'jellyfin'
#    user: '126:132' 
    network_mode: 'bridge'
    environment:
      - PUID='126'
      - PGID='132'
      - TZ='America/New_York'
      - JELLYFIN_PublishedServerUrl='IP_REDACTED'
    volumes:
      - /docker/jellyfin/files/config:/config
      - /docker/jellyfin/files/cache:/cache
      - /multimedia:/multimedia:ro
    devices:
      - /dev/dri/renderD128:/dev/dri/renderD128
      - /dev/dri/card0:/dev/dri/card0
    ports:
      - 8096:8096
      - 8920:8920
      - 7359:7359/udp
      - 1900:1900/udp
#    privileged: true
    restart: 'unless-stopped'

I may have added those ENVs during troubleshooting. The user/group do exist on the host:

root@REDACTED:/docker/jellyfin# id -u jellyfin
126
root@REDACTED:/docker/jellyfin# id -g jellyfin
132

Of course the user is part of the render group, and so forth. So, with the above dockerfile... things work, but as ROOT:

root@jellyfin:/# /usr/lib/jellyfin-ffmpeg/vainfo --display drm --device /dev/dri/renderD128
Trying display: drm
libva info: VA-API version 1.20.0
libva info: Trying to open /usr/lib/jellyfin-ffmpeg/lib/dri/iHD_drv_video.so
libva info: Found init function __vaDriverInit_1_20
libva info: va_openDriver() returns 0
vainfo: VA-API version: 1.20 (libva 2.20.0)
vainfo: Driver version: Intel iHD driver for Intel(R) Gen Graphics - 23.4.0 (05e4d0d)
vainfo: Supported profile and entrypoints
      VAProfileNone                   :	VAEntrypointVideoProc
      VAProfileNone                   :	VAEntrypointStats
      VAProfileMPEG2Simple            :	VAEntrypointVLD
      VAProfileMPEG2Simple            :	VAEntrypointEncSlice
      VAProfileMPEG2Main              :	VAEntrypointVLD
      VAProfileMPEG2Main              :	VAEntrypointEncSlice
      VAProfileH264Main               :	VAEntrypointVLD
      VAProfileH264Main               :	VAEntrypointEncSlice
      VAProfileH264Main               :	VAEntrypointFEI
      VAProfileH264Main               :	VAEntrypointEncSliceLP
      VAProfileH264High               :	VAEntrypointVLD
      VAProfileH264High               :	VAEntrypointEncSlice
      VAProfileH264High               :	VAEntrypointFEI
      VAProfileH264High               :	VAEntrypointEncSliceLP
      VAProfileVC1Simple              :	VAEntrypointVLD
      VAProfileVC1Main                :	VAEntrypointVLD
      VAProfileVC1Advanced            :	VAEntrypointVLD
      VAProfileJPEGBaseline           :	VAEntrypointVLD
      VAProfileJPEGBaseline           :	VAEntrypointEncPicture
      VAProfileH264ConstrainedBaseline:	VAEntrypointVLD
      VAProfileH264ConstrainedBaseline:	VAEntrypointEncSlice
      VAProfileH264ConstrainedBaseline:	VAEntrypointFEI
      VAProfileH264ConstrainedBaseline:	VAEntrypointEncSliceLP
      VAProfileVP8Version0_3          :	VAEntrypointVLD
      VAProfileHEVCMain               :	VAEntrypointVLD
      VAProfileHEVCMain               :	VAEntrypointEncSlice
      VAProfileHEVCMain               :	VAEntrypointFEI
      VAProfileHEVCMain               :	VAEntrypointEncSliceLP
      VAProfileHEVCMain10             :	VAEntrypointVLD
      VAProfileHEVCMain10             :	VAEntrypointEncSlice
      VAProfileHEVCMain10             :	VAEntrypointEncSliceLP
      VAProfileVP9Profile0            :	VAEntrypointVLD
      VAProfileVP9Profile0            :	VAEntrypointEncSliceLP
      VAProfileVP9Profile1            :	VAEntrypointVLD
      VAProfileVP9Profile1            :	VAEntrypointEncSliceLP
      VAProfileVP9Profile2            :	VAEntrypointVLD
      VAProfileVP9Profile2            :	VAEntrypointEncSliceLP
      VAProfileVP9Profile3            :	VAEntrypointVLD
      VAProfileVP9Profile3            :	VAEntrypointEncSliceLP
      VAProfileHEVCMain12             :	VAEntrypointVLD
      VAProfileHEVCMain12             :	VAEntrypointEncSlice
      VAProfileHEVCMain422_10         :	VAEntrypointVLD
      VAProfileHEVCMain422_10         :	VAEntrypointEncSlice
      VAProfileHEVCMain422_12         :	VAEntrypointVLD
      VAProfileHEVCMain422_12         :	VAEntrypointEncSlice
      VAProfileHEVCMain444            :	VAEntrypointVLD
      VAProfileHEVCMain444            :	VAEntrypointEncSliceLP
      VAProfileHEVCMain444_10         :	VAEntrypointVLD
      VAProfileHEVCMain444_10         :	VAEntrypointEncSliceLP
      VAProfileHEVCMain444_12         :	VAEntrypointVLD
      VAProfileHEVCSccMain            :	VAEntrypointVLD
      VAProfileHEVCSccMain            :	VAEntrypointEncSliceLP
      VAProfileHEVCSccMain10          :	VAEntrypointVLD
      VAProfileHEVCSccMain10          :	VAEntrypointEncSliceLP
      VAProfileHEVCSccMain444         :	VAEntrypointVLD
      VAProfileHEVCSccMain444         :	VAEntrypointEncSliceLP
      VAProfileAV1Profile0            :	VAEntrypointVLD
      VAProfileHEVCSccMain444_10      :	VAEntrypointVLD
      VAProfileHEVCSccMain444_10      :	VAEntrypointEncSliceLP

But when I uncomment [user: '126:132'] in the dockerfile... things break...

I have no name!@jellyfin:/$ /usr/lib/jellyfin-ffmpeg/vainfo --display drm --device /dev/dri/renderD128
Trying display: drm
Failed to open the given device!
I have no name!@jellyfin:/$

So, maybe I am missing some documentation on how to properly pass the username/group to the docker container so that it auto-creates the user/group? IDK.

@polskikrol commented on GitHub (Mar 6, 2024): I believe to be using the correct image: ``` version: '3.8' services: jellyfin: image: 'jellyfin/jellyfin:latest' container_name: 'jellyfin' hostname: 'jellyfin' # user: '126:132' network_mode: 'bridge' environment: - PUID='126' - PGID='132' - TZ='America/New_York' - JELLYFIN_PublishedServerUrl='IP_REDACTED' volumes: - /docker/jellyfin/files/config:/config - /docker/jellyfin/files/cache:/cache - /multimedia:/multimedia:ro devices: - /dev/dri/renderD128:/dev/dri/renderD128 - /dev/dri/card0:/dev/dri/card0 ports: - 8096:8096 - 8920:8920 - 7359:7359/udp - 1900:1900/udp # privileged: true restart: 'unless-stopped' ``` I may have added those ENVs during troubleshooting. The user/group do exist on the host: ``` root@REDACTED:/docker/jellyfin# id -u jellyfin 126 root@REDACTED:/docker/jellyfin# id -g jellyfin 132 ``` Of course the user is part of the render group, and so forth. So, with the above dockerfile... things work, but as ROOT: ``` root@jellyfin:/# /usr/lib/jellyfin-ffmpeg/vainfo --display drm --device /dev/dri/renderD128 Trying display: drm libva info: VA-API version 1.20.0 libva info: Trying to open /usr/lib/jellyfin-ffmpeg/lib/dri/iHD_drv_video.so libva info: Found init function __vaDriverInit_1_20 libva info: va_openDriver() returns 0 vainfo: VA-API version: 1.20 (libva 2.20.0) vainfo: Driver version: Intel iHD driver for Intel(R) Gen Graphics - 23.4.0 (05e4d0d) vainfo: Supported profile and entrypoints VAProfileNone : VAEntrypointVideoProc VAProfileNone : VAEntrypointStats VAProfileMPEG2Simple : VAEntrypointVLD VAProfileMPEG2Simple : VAEntrypointEncSlice VAProfileMPEG2Main : VAEntrypointVLD VAProfileMPEG2Main : VAEntrypointEncSlice VAProfileH264Main : VAEntrypointVLD VAProfileH264Main : VAEntrypointEncSlice VAProfileH264Main : VAEntrypointFEI VAProfileH264Main : VAEntrypointEncSliceLP VAProfileH264High : VAEntrypointVLD VAProfileH264High : VAEntrypointEncSlice VAProfileH264High : VAEntrypointFEI VAProfileH264High : VAEntrypointEncSliceLP VAProfileVC1Simple : VAEntrypointVLD VAProfileVC1Main : VAEntrypointVLD VAProfileVC1Advanced : VAEntrypointVLD VAProfileJPEGBaseline : VAEntrypointVLD VAProfileJPEGBaseline : VAEntrypointEncPicture VAProfileH264ConstrainedBaseline: VAEntrypointVLD VAProfileH264ConstrainedBaseline: VAEntrypointEncSlice VAProfileH264ConstrainedBaseline: VAEntrypointFEI VAProfileH264ConstrainedBaseline: VAEntrypointEncSliceLP VAProfileVP8Version0_3 : VAEntrypointVLD VAProfileHEVCMain : VAEntrypointVLD VAProfileHEVCMain : VAEntrypointEncSlice VAProfileHEVCMain : VAEntrypointFEI VAProfileHEVCMain : VAEntrypointEncSliceLP VAProfileHEVCMain10 : VAEntrypointVLD VAProfileHEVCMain10 : VAEntrypointEncSlice VAProfileHEVCMain10 : VAEntrypointEncSliceLP VAProfileVP9Profile0 : VAEntrypointVLD VAProfileVP9Profile0 : VAEntrypointEncSliceLP VAProfileVP9Profile1 : VAEntrypointVLD VAProfileVP9Profile1 : VAEntrypointEncSliceLP VAProfileVP9Profile2 : VAEntrypointVLD VAProfileVP9Profile2 : VAEntrypointEncSliceLP VAProfileVP9Profile3 : VAEntrypointVLD VAProfileVP9Profile3 : VAEntrypointEncSliceLP VAProfileHEVCMain12 : VAEntrypointVLD VAProfileHEVCMain12 : VAEntrypointEncSlice VAProfileHEVCMain422_10 : VAEntrypointVLD VAProfileHEVCMain422_10 : VAEntrypointEncSlice VAProfileHEVCMain422_12 : VAEntrypointVLD VAProfileHEVCMain422_12 : VAEntrypointEncSlice VAProfileHEVCMain444 : VAEntrypointVLD VAProfileHEVCMain444 : VAEntrypointEncSliceLP VAProfileHEVCMain444_10 : VAEntrypointVLD VAProfileHEVCMain444_10 : VAEntrypointEncSliceLP VAProfileHEVCMain444_12 : VAEntrypointVLD VAProfileHEVCSccMain : VAEntrypointVLD VAProfileHEVCSccMain : VAEntrypointEncSliceLP VAProfileHEVCSccMain10 : VAEntrypointVLD VAProfileHEVCSccMain10 : VAEntrypointEncSliceLP VAProfileHEVCSccMain444 : VAEntrypointVLD VAProfileHEVCSccMain444 : VAEntrypointEncSliceLP VAProfileAV1Profile0 : VAEntrypointVLD VAProfileHEVCSccMain444_10 : VAEntrypointVLD VAProfileHEVCSccMain444_10 : VAEntrypointEncSliceLP ``` But when I uncomment [user: '126:132'] in the dockerfile... things break... ``` I have no name!@jellyfin:/$ /usr/lib/jellyfin-ffmpeg/vainfo --display drm --device /dev/dri/renderD128 Trying display: drm Failed to open the given device! I have no name!@jellyfin:/$ ``` So, maybe I am missing some documentation on how to properly pass the username/group to the docker container so that it auto-creates the user/group? IDK.

backuprepo commented

2025-12-22 01:51:25 +01:00

Author

Owner

@JPVenson commented on GitHub (Mar 6, 2024):

      - PUID='126'
      - PGID='132'

Enviorment variables are not supported by the official image as far as i know. Only by the LISO image.

@JPVenson commented on GitHub (Mar 6, 2024): ``` - PUID='126' - PGID='132' ``` Enviorment variables are not supported by the official image as far as i know. Only by the LISO image.

backuprepo commented

2025-12-22 01:51:31 +01:00

Author

Owner

@TimGels commented on GitHub (Mar 6, 2024):

I never used hwa myself but this still looks like the hwa device jellyfin is trying to access has other permissions.

@TimGels commented on GitHub (Mar 6, 2024): I never used hwa myself but this still looks like the hwa device jellyfin is trying to access has other permissions.

backuprepo commented

2025-12-22 01:51:35 +01:00

Author

Owner

@TimGels commented on GitHub (Mar 6, 2024):

Is renderD128 part of render / video or another group / user perhaps?

@TimGels commented on GitHub (Mar 6, 2024): Is renderD128 part of render / video or another group / user perhaps?

backuprepo commented

2025-12-22 01:51:40 +01:00

Author

Owner

@JPVenson commented on GitHub (Mar 6, 2024):

Well our docs are quite extensive on what is expected for HWA with intel devices on docker:
https://jellyfin.org/docs/general/administration/hardware-acceleration/intel#configure-with-linux-virtualization

However this works as intended and is not a bug therefor i am closing this issue.
If you need further help, you are always welcome to join one of our chats
https://jellyfin.org/contact/

@JPVenson commented on GitHub (Mar 6, 2024): Well our docs are quite extensive on what is expected for HWA with intel devices on docker: https://jellyfin.org/docs/general/administration/hardware-acceleration/intel#configure-with-linux-virtualization However this works as intended and is not a bug therefor i am closing this issue. If you need further help, you are always welcome to join one of our chats https://jellyfin.org/contact/

backuprepo commented

2025-12-22 01:51:43 +01:00

Author

Owner

@polskikrol commented on GitHub (Mar 6, 2024):

So does it have to run as root?

On Wed, Mar 6, 2024 at 10:25 JPVenson @.***> wrote:

Well our docs are quite extensive on what is expected for HWA with intel
devices on docker:

https://jellyfin.org/docs/general/administration/hardware-acceleration/intel#configure-with-linux-virtualization

However this works as intended and is not a bug therefor i am closing this
issue.
If you need further help, you are always welcome to join one of our chats
https://jellyfin.org/contact/

—
Reply to this email directly, view it on GitHub
https://github.com/jellyfin/jellyfin/issues/11115#issuecomment-1981126326,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/AKAGRDAYD6EMJGIOSNYLRGLYW4YNFAVCNFSM6AAAAABEJESBKWVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTSOBRGEZDMMZSGY
.
You are receiving this because you authored the thread.Message ID:
@.***>

@polskikrol commented on GitHub (Mar 6, 2024): So does it have to run as root? On Wed, Mar 6, 2024 at 10:25 JPVenson ***@***.***> wrote: > Well our docs are quite extensive on what is expected for HWA with intel > devices on docker: > > https://jellyfin.org/docs/general/administration/hardware-acceleration/intel#configure-with-linux-virtualization > > However this works as intended and is not a bug therefor i am closing this > issue. > If you need further help, you are always welcome to join one of our chats > https://jellyfin.org/contact/ > > — > Reply to this email directly, view it on GitHub > <https://github.com/jellyfin/jellyfin/issues/11115#issuecomment-1981126326>, > or unsubscribe > <https://github.com/notifications/unsubscribe-auth/AKAGRDAYD6EMJGIOSNYLRGLYW4YNFAVCNFSM6AAAAABEJESBKWVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTSOBRGEZDMMZSGY> > . > You are receiving this because you authored the thread.Message ID: > ***@***.***> >

backuprepo commented

2025-12-22 01:51:46 +01:00

Author

Owner

@TimGels commented on GitHub (Mar 6, 2024):

Not to my knowledge. It is 99% certain this is a permission issue.

@TimGels commented on GitHub (Mar 6, 2024): Not to my knowledge. It is 99% certain this is a permission issue.

backuprepo commented

2025-12-22 01:51:47 +01:00

Author

Owner

@polskikrol commented on GitHub (Mar 6, 2024):

So, I may have been mixing up elements from the official docker image and the secondary one. Cleaned up my docker-compose.yml and it looks good now. Also, added a new bridge network to this host so that I can manually manage the IP addresses assigned.

version: '3.8'
services:
  jellyfin:
    image: 'jellyfin/jellyfin:latest'
    container_name: 'jellyfin'
    hostname: 'jellyfin'
    networks:
      docker_bridge:
        ipv4_address: '172.16.0.1'
    user: '126:132' # host jellyfin user id
    group_add:
      - '109' # host render group id
    volumes:
      - /docker/jellyfin/files/config:/config
      - /docker/jellyfin/files/cache:/cache
      - /multimedia:/multimedia:ro
    devices:
      - /dev/dri/renderD128:/dev/dri/renderD128
      - /dev/dri/card0:/dev/dri/card0
    ports:
      - 8096:8096
      - 8920:8920
      - 7359:7359/udp
      - 1900:1900/udp
#    privileged: true
    restart: 'unless-stopped'
networks:
  docker_bridge:
    external: true

Hope this helps others as well. The official docker image uses native like docker declarations while the secondary image uses environmental variables. Jellyfin user doesnt have to exist on the docker container, and it only needs to have proper render permissions.

Cheers! This can be closed.

@polskikrol commented on GitHub (Mar 6, 2024): So, I may have been mixing up elements from the official docker image and the secondary one. Cleaned up my docker-compose.yml and it looks good now. Also, added a new bridge network to this host so that I can manually manage the IP addresses assigned. ``` version: '3.8' services: jellyfin: image: 'jellyfin/jellyfin:latest' container_name: 'jellyfin' hostname: 'jellyfin' networks: docker_bridge: ipv4_address: '172.16.0.1' user: '126:132' # host jellyfin user id group_add: - '109' # host render group id volumes: - /docker/jellyfin/files/config:/config - /docker/jellyfin/files/cache:/cache - /multimedia:/multimedia:ro devices: - /dev/dri/renderD128:/dev/dri/renderD128 - /dev/dri/card0:/dev/dri/card0 ports: - 8096:8096 - 8920:8920 - 7359:7359/udp - 1900:1900/udp # privileged: true restart: 'unless-stopped' networks: docker_bridge: external: true ``` Hope this helps others as well. The official docker image uses native like docker declarations while the secondary image uses environmental variables. Jellyfin user doesnt have to exist on the docker container, and it only needs to have proper render permissions. Cheers! This can be closed.

backuprepo commented

2025-12-22 01:51:50 +01:00

Author

Owner

@polskikrol commented on GitHub (Mar 6, 2024):

JPVenson

@JPVenson Spot on! That direct html bookmark link steered me in the right direction. Not sure how I have missed this tidbit over the past year. Thank you very much and apologies for being a pain. Hope this issue/thread helps others in the future.

@polskikrol commented on GitHub (Mar 6, 2024): > [JPVenson](/JPVenson) @JPVenson Spot on! That direct html bookmark link steered me in the right direction. Not sure how I have missed this tidbit over the past year. Thank you very much and apologies for being a pain. Hope this issue/thread helps others in the future.

Rows
Columns

[Issue]: Docker Container Missing Jellyfin User #5506

Please describe your bug

Reproduction Steps

Jellyfin Version

if other:

Environment

Jellyfin logs

FFmpeg logs

Please attach any browser or client logs here

Please attach any screenshots here

Code of Conduct