Jellyfin

Description / name	Input element
Container Registry
Container Configuration Root Path
Global /movies Path
Global /tv Path
Timezone
User ID
Group ID
Jellyfin Host Port
Jellyfin /config Path
Jellyfin /cache Path

Volunteer-built media solution that puts you in control — stream to any device from your own server, with no strings attached.


Port	`8096`
Registry	`ghcr.io/daemonless/jellyfin`
Daemonless	daemonless/jellyfin
Source	jellyfin/jellyfin
Website	jellyfin.org

Version Tags

Tag	Description	Best For
`latest` / `pkg`	FreeBSD Quarterly. Uses stable, tested packages.	Most users — recommended.
`pkg-latest`	FreeBSD Latest. Rolling package updates.	Staying current.

Before deploying, ensure your host environment is ready. See the Quick Start Guide for host setup instructions, including the security model for host vs. container privileges.

Deployment

Podman AppJail Bastille

Compose CLI Ansible

services:
  jellyfin:
    image: "ghcr.io/daemonless/jellyfin:latest"
    container_name: jellyfin
    environment:
      - PUID=1000  # User ID for the application process
      - PGID=1000  # Group ID for the application process
      - TZ=UTC  # Timezone for the container
      - FFMPEG_PATH=/usr/local/bin/jellyfin-ffmpeg  # Path to the FFmpeg binary. Options: /usr/local/bin/jellyfin-ffmpeg (default) or /usr/local/bin/ffmpeg
    volumes:
      - "/path/to/containers/jellyfin:/config"
      - "/path/to/containers/jellyfin/cache:/cache" # optional
      - "/path/to/tv:/tv" # optional
      - "/path/to/movies:/movies" # optional
    ports:
      - "8096:8096"
    annotations:
      org.freebsd.jail.allow.mlock: "true"
    # always (not unless-stopped) so FreeBSD's podman rc.d auto-starts it at boot
    restart: always

Save as compose.yaml, then run podman-compose up -d.

podman run -d --name jellyfin \
  -p 8096:8096 \
  --annotation 'org.freebsd.jail.allow.mlock=true' \
  -e PUID=1000 \
  -e PGID=1000 \
  -e TZ=UTC \
  -e FFMPEG_PATH=/usr/local/bin/jellyfin-ffmpeg \
  -v /path/to/containers/jellyfin:/config \
  -v /path/to/containers/jellyfin/cache:/cache # optional \
  -v /path/to/tv:/tv # optional \
  -v /path/to/movies:/movies # optional \
  ghcr.io/daemonless/jellyfin:latest

Save as run.sh, then run sh run.sh.

- name: Deploy jellyfin
  containers.podman.podman_container:
    name: jellyfin
    image: "ghcr.io/daemonless/jellyfin:latest"
    state: started
    restart_policy: always
    env:
      PUID: "1000"
      PGID: "1000"
      TZ: "UTC"
      FFMPEG_PATH: "/usr/local/bin/jellyfin-ffmpeg"
    ports:
      - "8096:8096"
    volumes:
      - "/path/to/containers/jellyfin:/config"
      - "/path/to/containers/jellyfin/cache:/cache" # optional
      - "/path/to/tv:/tv" # optional
      - "/path/to/movies:/movies" # optional
    annotation:
      org.freebsd.jail.allow.mlock: "true"

Save as jellyfin-deploy.yaml, then run ansible-playbook jellyfin-deploy.yaml.

Warning

Exposing ports in AppJail means that your service can be reached from remote hosts. If that is not your intention, do not expose the ports and communicate with the service using the jail's IPv4 address or hostname assigned by the virtual network.

Director CLI

# .env

DIRECTOR_PROJECT=jellyfin
PUID=1000
PGID=1000
TZ=UTC
FFMPEG_PATH=/usr/local/bin/jellyfin-ffmpeg

# appjail-director.yml

options:
  - virtualnet: ':<random> default'
  - nat:
services:
  jellyfin:
    name: jellyfin
    options:
      - container: 'args:--pull'
      - expose: '8096:8096 proto:tcp'
      - template: !ENV '${PWD}/template.conf'
    oci:
      user: root
      environment:
        - PUID: !ENV '${PUID}'
        - PGID: !ENV '${PGID}'
        - TZ: !ENV '${TZ}'
        - FFMPEG_PATH: !ENV '${FFMPEG_PATH}'
    volumes:
      - JELLYFIN_CONFIG_PATH: /config
      - JELLYFIN_CACHE_PATH: /cache
      - TV_PATH: /tv
      - MOVIES_PATH: /movies
volumes:
  JELLYFIN_CONFIG_PATH:
    device: '/path/to/containers/jellyfin'
  JELLYFIN_CACHE_PATH:
    device: '/path/to/containers/jellyfin/cache'
  TV_PATH:
    device: '/path/to/tv'
  MOVIES_PATH:
    device: '/path/to/movies'

# Makejail

ARG tag=latest

OPTION container=boot
OPTION overwrite=force
OPTION from=ghcr.io/daemonless/jellyfin:${tag}

# template.conf

exec.start: "/bin/sh /etc/rc"
exec.stop: "/bin/sh /etc/rc.shutdown jail"
mount.devfs
persist
allow.mlock

Save the files above, then run appjail-director up.

appjail oci run -Pd \
  -o overwrite=force \
  -o container="args:--pull" \
  -o virtualnet=":<random> default" \
  -o nat \
  -o template=template.conf \
  -o expose="8096:8096 proto:tcp" \
  -e PUID=1000 \
  -e PGID=1000 \
  -e TZ=UTC \
  -e FFMPEG_PATH=/usr/local/bin/jellyfin-ffmpeg \
  -o fstab="/path/to/containers/jellyfin /config <pseudofs>" \
  -o fstab="/path/to/containers/jellyfin/cache /cache <pseudofs>" \ # optional
  -o fstab="/path/to/tv /tv <pseudofs>" \ # optional
  -o fstab="/path/to/movies /movies <pseudofs>" \ # optional
  ghcr.io/daemonless/jellyfin:latest jellyfin

template.conf:

# template.conf

exec.start: "/bin/sh /etc/rc"
exec.stop: "/bin/sh /etc/rc.shutdown jail"
mount.devfs
persist
allow.mlock

Save the files above, then run sh run.sh.

Experimental

Bastille's OCI support is experimental. It requires buildah and shares the host network stack (inherit). Mount volumes with --volume HOST JAIL; without it, image-declared volumes are stored under ${bastille_volumesdir}/${jail}.

Compose CLI

services:
  jellyfin:
    name: jellyfin
    image: "ghcr.io/daemonless/jellyfin:latest"
    network:
      - mode: host
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=UTC
      - FFMPEG_PATH=/usr/local/bin/jellyfin-ffmpeg
    volumes:
      - "/path/to/containers/jellyfin:/config"
      - "/path/to/containers/jellyfin/cache:/cache"
      - "/path/to/tv:/tv"
      - "/path/to/movies:/movies"

Save as bastille-compose.yml, then run bastille up.

bastille create -O \
  --env PUID=1000 \
  --env PGID=1000 \
  --env TZ=UTC \
  --env FFMPEG_PATH=/usr/local/bin/jellyfin-ffmpeg \
  --volume /path/to/containers/jellyfin /config \
  --volume /path/to/containers/jellyfin/cache /cache \
  --volume /path/to/tv /tv \
  --volume /path/to/movies /movies \
  jellyfin ghcr.io/daemonless/jellyfin:latest inherit

Access at: http://localhost:8096

Interactive Configuration

Parameters

Environment Variables

Variable	Default	Description
`PUID`	`1000`	User ID for the application process
`PGID`	`1000`	Group ID for the application process
`TZ`	`UTC`	Timezone for the container
`FFMPEG_PATH`	`/usr/local/bin/jellyfin-ffmpeg`	Path to the FFmpeg binary. Options: /usr/local/bin/jellyfin-ffmpeg (default) or /usr/local/bin/ffmpeg

Volumes

Path	Description
`/config`	Configuration directory
`/cache`	Cache directory (Optional)
`/tv`	TV Series library (Optional)
`/movies`	Movie library (Optional)

Ports

Port	Protocol	Description
`8096`	TCP	Web UI

FFmpeg vs. Jellyfin-FFmpeg

This image includes both standard ffmpeg and jellyfin-ffmpeg. By default, it uses jellyfin-ffmpeg (via the FFMPEG_PATH environment variable).

Why use jellyfin-ffmpeg? While raw encoding performance is similar, jellyfin-ffmpeg includes critical patches for HDR to SDR tone mapping (specifically the tonemapx filter). Stock FFmpeg lacks a proper BT.2390 implementation, which results in "washed out" or blown-out colors when serving HDR10 content to SDR displays.

Port Status Note that jellyfin-ffmpeg is not currently in the official FreeBSD ports tree, but it is provided in this image to ensure a high-quality transcoding experience identical to the official Jellyfin Linux distributions.

Hardware Acceleration (VAAPI)

Intel iGPU hardware transcoding is supported via VAAPI. The image includes libva, libva-intel-media-driver, and gmmlib.

Host setup required — the GPU must be enabled and a devfs ruleset must expose the DRI devices into the jail:

Install the DRM kernel module and firmware:

1
2
3

pkg install drm-kmod libva-intel-media-driver gmmlib
echo 'kld_list="i915kms"' >> /etc/rc.conf
kldload i915kms

Add a devfs ruleset to /etc/devfs.rules:

[devfsrules_jails_gpu=61182]
add include $devfsrules_hide_all
add include $devfsrules_unhide_basic
add include $devfsrules_unhide_login
add path 'bpf*' unhide
add path 'dri' unhide
add path 'dri/*' unhide mode 0666
add path 'drm*' unhide mode 0666

Configure the jail to use ruleset 61182 and enable allow.mlock (already set in the example compose above).
In Jellyfin: Dashboard → Playback → Transcoding → set Hardware acceleration to VAAPI, device /dev/dri/renderD128.

Implementation Details

Architectures: amd64
User: bsd (UID/GID set via PUID/PGID). Defaults to 1000:1000.
Base: Built on ghcr.io/daemonless/base (FreeBSD 15.1).
mlock: Requires --annotation 'org.freebsd.jail.allow.mlock=true' (ocijail 0.5.0+)

Need help? Join our Discord community.