You can run Jellyfin on Proxmox in an unprivileged LXC container and still get hardware transcoding: Proxmox’s built-in Device Passthrough option hands the Intel iGPU to the container, and your media mounts from a NAS through the host, with no privileged container and no hand-edited config file. The finished Jellyfin Proxmox LXC shares the host’s kernel, so it uses far less than a virtual machine (here’s how LXC containers differ from VMs on Proxmox).
As of October 2026 (Proxmox VE 9.2 and Jellyfin 12.2), hardware acceleration here needs a CPU with an iGPU, and Intel is generally your best bet (Jellyfin’s Quick Sync support on Linux covers 5th gen and newer). NVIDIA cards work differently and aren’t covered here.
Creating an Unprivileged Jellyfin LXC Container
Jellyfin runs fine in Proxmox’s default unprivileged container now, with the iGPU passed through in the GUI and the share mounted on the host. Proxmox’s docs say privileged containers should only be used in trusted environments.
When I built this in March 2024, the Jellyfin container was privileged. I was pulling media over NFS from my Synology NAS, and Proxmox only offers NFS and SMB/CIFS on a privileged container, so I kept Jellyfin in its own privileged LXC and left my Docker LXC unprivileged, since a privileged container has root access to the host. I was also on Proxmox VE 8.1.4 and edited the container’s config file by hand (passing a device to a container in the GUI arrived in 8.2).
For the template, use Ubuntu 24.04 or Debian 13. I went with Ubuntu in 2024 because I’d found it ran a little better than Debian, but skip Ubuntu 25.04, as Jellyfin’s install script will not run on it.
1. Select your local storage, then CT Templates, then Templates, and download ubuntu-24.04-standard (or debian-13-standard).
2. Select Create CT in the top right, give the container a Hostname and a Password, and leave Unprivileged container ticked.
3. In the Template tab, select the template you downloaded.
4. Set the Disk size, CPU and Memory. I used 20GB, 2 cores and 2GB of memory on an N100 mini PC.
5. In the Network tab, set IPv4 and IPv6 to DHCP, unless you’d like a static IP.
6. Check the Confirm tab and select Finish.
Proxmox Jellyfin Hardware Acceleration (iGPU Passthrough)
Since Proxmox VE 8.2, the GUI can pass a host device straight into a container. You give the container the iGPU’s render node, /dev/dri/renderD128, and the group ID that owns it inside the container. Handing a whole GPU to a virtual machine is a different process (GPU passthrough on Proxmox).
Checking the iGPU on the Proxmox Host
1. Select your node, open the Shell, and list the DRI devices. You should see renderD128.
ls -l /dev/driIf there’s no renderD128, enable the iGPU in the BIOS.
The host doesn’t need Intel’s media drivers for Jellyfin, since Jellyfin’s ffmpeg brings its own. If you’d like to check the iGPU with vainfo anyway, add non-free to the first Components line (the deb.debian.org one) in /etc/apt/sources.list.d/debian.sources. Without a subscription, also Disable the enterprise entries and Add the No-Subscription repository under the node’s Updates → Repositories. Then run:
apt update && apt install vainfo intel-media-va-driver-non-free -y
vainfo
Adding the Render Device with Device Passthrough
1. Start the container, open its Console, log in as root, and update it.
apt update && apt upgrade -y
2. Look up the GID of the render group inside the container and write it down.
getent group render
Mine was 108 on Ubuntu 22.04, but it differs between templates.
3. Logged in as root@pam (other accounts cannot use this), select the container, then Resources, Add, and finally, Device Passthrough.
4. Enter /dev/dri/renderD128 as the Device Path, tick Advanced, and set GID in CT to the GID from step 2. Leave the other fields at their defaults and select Add.
5. Reboot the container so it picks up the device.
Mounting Your Media in the Jellyfin LXC
An unprivileged container cannot mount NFS or SMB shares itself, so you mount the share on the Proxmox host and hand it to the container as a bind mount.
1. On your NAS, give the Proxmox host’s IP address Read/Write access in the share’s NFS permissions, because Proxmox creates a folder in the share when you add it. On a Synology, that’s the NFS permissions on your Synology NAS screen, with Squash set to Map all users to admin.
2. In Proxmox, select Datacenter, then Storage, Add, and finally, NFS (or SMB/CIFS). Give it an ID, enter your NAS’s IP as the Server, pick the share under Export (Share on SMB/CIFS, with a Read/Write account’s username and password), and select Add. Proxmox mounts it at /mnt/pve/ followed by that ID.
3. In the node’s Shell, add the bind mount with your container and storage IDs (add ,ro=1 to make it read-only).
pct set [ID] -mp0 /mnt/pve/[STORAGE_ID],mp=/media4. Restart the container and check the folder from its console.
ls /mediaThis has to be done in the shell, since the GUI’s Add → Mount Point creates a new volume, not a bind mount.
Files on the share will show as owned by nobody, because an unprivileged container maps its IDs to a higher range on the host. That’s fine for a library Jellyfin only reads. Bind mounts also aren’t included in vzdump backups, which is what you want for media.
How to Install Jellyfin on Proxmox
Jellyfin’s install script is provided by Jellyfin (manual options are on their website), and you now verify it before running it. The community-scripts.org Jellyfin script builds the whole container in one command, but it’s a community project, not Proxmox’s, and building it by hand means you know each piece when something breaks.
1. In the container’s console, install curl, download the script and its checksum, and verify it. You should see install-debuntu.sh: OK.
apt install curl -y
curl -s https://repo.jellyfin.org/install-debuntu.sh -O
curl -s https://repo.jellyfin.org/install-debuntu.sh.sha256sum -O
sha256sum -c install-debuntu.sh.sha256sum2. Run the script and press Enter when it asks to continue.
bash install-debuntu.sh3. Add the jellyfin user to the render group and restart Jellyfin.
usermod -aG render jellyfin
systemctl restart jellyfin4. Confirm Jellyfin can see the iGPU with its own copy of vainfo. If it lists the iHD driver, the passthrough worked.
/usr/lib/jellyfin-ffmpeg/vainfo --display drm --device /dev/dri/renderD128
Configuring the Jellyfin Application
Open the container’s IP address on port 8096 (ip a shows it).
http://[LXC_IP]:80961. Pick your language, then select Next.
2. Enter a username and password, then select Next.
3. Add a library for each content type, pointing it at its folder under /media.
4. Select your metadata settings, then select Next.
5. On Set up Remote Access, leave Allow remote connections to this server as it is and select Next. For watching away from home, a VPN like WireGuard or Tailscale is a better route than opening ports. Security changes, so nothing here is a guarantee.
6. Select Finish.
Turning On Hardware Acceleration in Jellyfin
1. Open the Dashboard, then Playback, and finally, Transcoding.
2. Set Hardware acceleration to Intel Quicksync (QSV) and the QSV Device to /dev/dri/renderD128.
3. Tick the codecs your iGPU supports under Enable hardware decoding for, make sure Enable hardware encoding is ticked, and select Save.
On an N100 you can tick Enable Intel Low-Power H.264 hardware encoder and Enable Intel Low-Power HEVC hardware encoder (both are off by default). Jasper Lake and Elkhart Lake chips like the N5105 only encode in Low-Power mode and need HuC firmware set up on the host first.
To test it, play something, select the gear icon, lower the Quality (I used 480p when I tested mine), then open Playback Info from the same menu. You should see Transcoding Info, and intel_gpu_top on the host (from the intel-gpu-tools package) shows the Video engine busy.
Transcoding is far more efficient on the GPU than on the CPU (why hardware transcoding matters for Jellyfin).
Troubleshooting Hardware Transcoding
- The wrong GID in CT. Run
getent group renderin the container, then edit the device under Resources and correct GID in CT, then reboot the container. - jellyfin isn’t in the render group. Rerun the usermod command.
- Low-power encoding on an older chip. Untick the Low-Power encoders, or on Jasper Lake and Elkhart Lake, set up the HuC firmware.
How to Update Jellyfin in an LXC Container
Jellyfin comes from its own repository, so it updates with the container’s packages.
apt update && apt upgrade -yBack up the container before a major release (Proxmox won’t snapshot a container with a bind mount). Jellyfin 12.0 made database changes that cannot be rolled back without a full restore, and its release notes say to remove any plugins that aren’t built in first and run a full library scan after.
When updates have broken things for me, restoring a backup was easier than fixing them, and that’s a big part of why I picked Proxmox in the first place.
