LXC everything in my Jellyfin/DVD ripper stack

Dev Zone Devember
1

AI Disclosure:
I will use AI rather heavily to review configurations but the entire idea is to write all my steps down, create a repeatable and iterated process because to “just PCI passthrough” was good enough when I was partially on Windows but now I want to figure out some true extensibility of the proxmox platform and the openness of Linux

So AI will assist in editing config files, generating some bespoke scripts.

I technically started this project last week. My Jellyfin server was a full-fat VM with the Intel iGPU passed over PCI Express

Since the DVD drives and the ZFS storage volume live on the same host I wanted to see if it was possible to have them converted to LXC and share a common ZFS volume since it’s the same host.

The migration of Jellyfin went as follows:

  1. Create the LXC
  2. Migrate the 5+ terabytes of library data via rsync from the VM to the LXC.
  3. Retire the VM
  4. Using standard device pass through for the LXC I was able to get the LXC to use Intel quick sync
  5. I had AI generate a synchronization script to confirm the right /dev/dri/renderDNNN device was mapped to the LXC
  6. Create a startup service to enforce the device assignment

I just published a topic in Virtualization about passing through an Nvidia GPU to a privileged LXC and that’s where I have left it for today (10+ hours on this going back and forth)

This is more a “learning with AI” because I want to repeat the steps at least a couple times to make sure I have written “the guide” so someone else can follow or I can replicate on some other project that has these needs

The Jellyfin media host is already showing way less RAM consumption than running traditional VMs and with the price of ram these days maybe it can help someone else.

This LXC with the Nvidia GPU will be responsible for taking the DVD content, transcode to H.265 and move the content to the media library.

I am not entirely confident for the Automatic Ripping Machine so what I am installing is MakeMKV and Handbrake to make sure it works manually.

And sway desktop because why not.

1 Like
2

These are the heavy-handed steps to getting a privileged LXC to at least nvidia-smi out on the container side.

3

Mapping file permissions today, just making a user on the privileged container to match the unprivileged one

root@nvd-jollybee:~# ls -la /jellyfin-media
total 532
drwxrwxr-x  10 101000 101000     13 Nov  7 21:33  .
drwxr-xr-x  19 root   root     4096 Nov  9 15:32  ..
-rwxrwx---   1 101000 101000      0 May 29  2025  .test
drwxrws---  40 101000 101000     46 Oct  6 06:26  Anime
drwxrws---   6 101000 101000      8 Feb 16  2026  Imported
drwxrws--- 229 101000 101000    359 Nov  6 03:00  Movies
drwxrws---  47 101000 101000     47 May 29  2025  Music
drwxrws---  58 101000 101000     58 Aug 17  2025 'Shows and Series'
drwxrws---   2 101000 101000      3 May 29  2025 'VLC Playlists'
-rw-rw-r--   1 101000 101000 703464 Nov  7 00:10  live-tv-eng.m3u
drwxrws---   2 101000 101000      2 May 29  2025  lost+found
-rwxrwx---   1 101000 101000      4 Jun 28  2025  test.txt

And just like that I have a “jellyfin” user in the correct ID group

root@nvd-jollybee:~# groupadd -g 101000 jellyfin
root@nvd-jollybee:~# useradd -u 101000 -g 101000 -M -s /usr/sbin/nologin jellyfin
useradd warning: jellyfin uid 101000 outside of the UID_MIN 1000 and UID_MAX 60000 range.
root@nvd-jollybee:~# ls -l /jellyfin-media
total 516
drwxrws---  40 jellyfin jellyfin     46 Oct  6 06:26  Anime
drwxrws---   6 jellyfin jellyfin      8 Feb 16  2026  Imported
drwxrws--- 229 jellyfin jellyfin    359 Nov  6 03:00  Movies
drwxrws---  47 jellyfin jellyfin     47 May 29  2025  Music
drwxrws---  58 jellyfin jellyfin     58 Aug 17  2025 'Shows and Series'
drwxrws---   2 jellyfin jellyfin      3 May 29  2025 'VLC Playlists'
-rw-rw-r--   1 jellyfin jellyfin 703464 Nov  7 00:10  live-tv-eng.m3u
drwxrws---   2 jellyfin jellyfin      2 May 29  2025  lost+found
-rwxrwx---   1 jellyfin jellyfin      4 Jun 28  2025  test.txt

What I used to do was share via Samba and connect over the network as needed to this Jellyfin media, but since I now have a privileged container, it’s possible to create an NFS export from there if I want network access to this media again.

Some more architecture notes, I made the zfs volume directly within the host shell

Since I have 3x 12TB drives in a RAID Z 1 configuration, it made good sense to host the jellyfin media on an extendable volume here without a full VM

root@proxmox-b:~# zfs list
NAME                       USED  AVAIL  REFER  MOUNTPOINT
radz-a                    5.15T  16.5T   170K  /radz-a
radz-a/media              4.88T  1.12T  4.88T  /radz-a/media
[....]

So the convenience of configuring it this way is to dynamically adjust quota, and have this volume dynamically update to two container hosts.

It creates a common mount point, and as long as I can get the UID and GID to line up or map to a user between each machine this will be fine.

If I wanted overkill, I would actually leverage my FreeIPA instance to handle the user identity mappings and single-sign on capabilities, but as I am still treading new territory, I did not want to introduce a domain Free IPA layer on top of this for now.

Why Free IPA at all?
It replaced Active Directory as my central identity provider, and it provides global sudo powers as long as sudo is installed on the given machine, and it can make setting up machines a bit easier. And it’s better to map file permissions on anything “shared” (internal, external or otherwise) to at least one central identity manager.

If I included Free IPA
I would probably create a Jellyfin service user that would be mapped on the media container, but because it would be recognized on all machines. I could use ACLs to grant more granular file permissions over the media data itself.

Something like:

  • Global permissions for /jellyfin-media
  • Read/Write/Execute ONLY on a sub-folder /jellyfin-media/import for the DVD machine to control access.