Published

Jellyfin

Free media server for your own movies, shows, music, books and photos, streamed to a web app and to TV, mobile and desktop clients, with users, watch history and on-the-fly transcoding with FFmpeg. The self-hosted stack is one container with an SQLite database.

Resources by load level

What the app itself needs at each level, next to what we recommend for a server that runs only this app.

Level	What it means	App requirements	Recommended
LightEstimate	Up to 3 users at home, ~1,000 movies and episodes, 2 streams at once with at most one 1080p SDR transcode on the CPU; ~50 new items a month.	2.5 vCPU · 2 GiB RAM · 24 GiB disk	3.12 vCPU · 3.9 GiB RAM · 36.915 GiB disk
MediumEstimate	Up to 10 users, ~5,000 movies and episodes, 4 streams at once with up to two 1080p SDR transcodes on the CPU; ~200 new items a month.	4.5 vCPU · 3.5 GiB RAM · 58 GiB disk	5.52 vCPU · 5.7 GiB RAM · 76.015 GiB disk
HeavyEstimate	Up to 25 users, ~20,000 movies and episodes, 8 streams at once with up to three 1080p SDR transcodes on the CPU, the rest direct play; ~500 new items a month.	7 vCPU · 6 GiB RAM · 140 GiB disk	8.52 vCPU · 8.7 GiB RAM · 170.315 GiB disk

Recommended = app requirements + system baseline + safety headroom, under sizing policy 2026.10.0. Options stay at their defaults. “Estimate” means the sources give no number for that case, so it is worked out from them by the method stated under Components. How the numbers are built

Size it in the Stack Sizer

Ready-to-run files

Support level Supported

Compose template from the official sources; not yet verified by a run.

Create docker-compose

Components

What each component needs at each load level, before baseline and headroom.

vCPU / GiB RAM / GiB disk
Component	Light	Medium	Heavy	Sources
Jellyfin (server, web client and FFmpeg) (app)	2.5 / 2 / 24	4.5 / 3.5 / 58	7 / 6 / 140	[3][12][13][14][21]

How the estimates are worked out

Jellyfin (server, web client and FFmpeg) · Light: Direct play costs almost nothing (docs); the docs give no per-stream CPU figure, so an assumed 2 vCPU per 1080p SDR software transcode + 0.5 for the server and scans. RAM: 1 GiB server + 0.5 GiB FFmpeg + a small library cache; the docs' 4–8 GB is for the whole machine. Disk: 753,959,538 B image × 3 (2.11 GiB) → 2.25 + 5 GiB metadata + cache rule 2 streams × an assumed 8 GiB largest file (16), rounded up to 24 GiB.
Jellyfin (server, web client and FFmpeg) · Medium: 2 software transcodes × an assumed 2 vCPU + 0.5 for the server, direct play and scans. RAM: 1 GiB server + 2 × 0.5 GiB FFmpeg + 1.5 GiB, since 10.11 caches metadata in RAM up to the database size. Disk: 2.25 GiB image + 15 GiB metadata (the low end of the docs' 10–100 GB for a moderate library) + 4 streams × an assumed 10 GiB largest file (40), rounded up to 58 GiB.
Jellyfin (server, web client and FFmpeg) · Heavy: 3 software transcodes × an assumed 2 vCPU + 1 for the server, 5 direct plays and long scans. HDR tone-mapping on the CPU is excluded: the docs say a Ryzen 9 5950X may not manage one stream. RAM: 1 GiB server + 3 × 0.5 GiB FFmpeg + 3.5 GiB metadata cache, within the docs' 8 GB machine. Disk: 2.25 GiB image + 40 GiB metadata + 8 streams × an assumed 12 GiB largest file (96), rounded up to 140 GiB.

Ports

Public ports are meant to be reached from outside the stack, usually through a reverse proxy; internal ones stay on the stack's own network.

Component	Port	Exposure	Purpose	Sources
Jellyfin (server, web client and FFmpeg)	8096/tcp	Public, through a proxy	Web client, HTTP API and streaming for every client app (HTTP; put behind TLS)	[2][6]

Every port in the catalog, with conflicts between apps

User and permissions (UID/GID)

The user each container's process runs as, and the paths it writes to. A bind mount for one of these paths must be writable by that UID:GID.

Component	UID:GID	User	Starts as root	Writes to	Sources
Jellyfin (server, web client and FFmpeg)Derived	0:0	`root`	No	`/config/cache/media`	[1][2][3]

Jellyfin (server, web client and FFmpeg): The Dockerfile sets no USER and starts /jellyfin/jellyfin directly, so it runs as root; /config and /cache are created mode 777 so the docs' optional user: uid:gid also works. Media is written only when NFO or artwork saving into media folders is on; the docs mount libraries read-only otherwise.

Storage growth

How much each component's data grows per month at each load level, on top of the disk in the profile. A value marked Assumption is ANAROQ's stated assumption, not a figure from the sources; the notes say what it rests on.

GiB per month
Component	Light	Medium	Heavy	Sources
Jellyfin (server, web client and FFmpeg)Assumption	0.488	1.953	4.883	[14][16][17]

What the growth figures rest on

Jellyfin (server, web client and FFmpeg): New items × an assumed 10 MiB each in /config (posters and backdrops, people images, chapter images when enabled, database rows): 50, 200 and 500 items a month. The media files themselves are not counted. /cache is emptied by the scheduled Clear Cache and Clear Transcodes tasks; built-in backups also land in /config.

Upgrade and rollback

How to move to a new version safely, and how to go back if it fails.

Back up first

Jellyfin has no downgrade: stop it and copy the whole config volume (database, metadata, settings and plugins). The cache volume can be skipped; the media is backed up on its own. [15][20]

Upgrade steps

Read the TL;DR of the release post for every major version on the way: 12.0 needs 10.10.7 or any 10.11.x first, fails on usernames that differ only in case, and does not load third-party plugins built for 10.11 (remove them first). [20][21]
Stop Jellyfin and take a full copy of the config volume, then change the pinned tag to the new packaging build, run docker compose pull and docker compose up -d. Migrations run on first start and can take hours on large libraries: do not stop the container; follow docker compose logs -f jellyfin. [4][15][20][21]
After a major upgrade run a full library scan (required after 12.0: automatically grouped versions are rebuilt from the files) and hard-refresh the web client. [20][21]

Roll back

Stop the container, restore the config volume from the copy taken before the upgrade, pin the previous tag and start again. Migrations rewrite the database on first start, so the old image alone cannot read it. [15][20]

Known breaking changes

In 12.0: Version numbers drop the leading 10 (12.0, 12.1, 12.2), so tag pins and scripts change. The schema is rewritten on first boot; only 10.10.7 or 10.11.x can upgrade; usernames become case-insensitive; a full scan is required; 10.11 plugins do not load; the legacy /emby/ and /mediabrowser/ routes and the deprecated sign-in are gone. [5][20]
In 10.11.0: The library database moved from library.db into jellyfin.db (EF Core) with migrations that can run for hours; only 10.10.7 can upgrade; 32-bit ARM is dropped and x86 CPUs need SSE4.1; metadata is cached in RAM up to the database size, so memory use rises. [12][21]

Limits

The template has no GPU, so every transcode runs on the CPU. The docs advise against a server without a GPU: HEVC, VP9 and AV1 decoding and HDR-to-SDR tone-mapping can exceed what one desktop CPU does in real time. Hardware acceleration needs devices and group_add lines added by hand. [11][12][13]
Plan disk for the transcode cache: the docs' rule is your largest media file × the concurrent streams, on an SSD next to the database. Keep /config on local disk, not on NFS or SMB; network libraries must be mounted on the host, and if they are offline scheduled tasks can drop items and playlists. [12][14][16]
Client auto-discovery (7359/udp) and DLNA (1900/udp with host networking) work only on the local subnet and are not part of the template: apps connect by entering the server's URL. [6][9]

Security

The first visitor of a fresh server runs the setup wizard and creates the administrator account. Finish the wizard right after the first start, before the domain points at the server. [18][20]
Jellyfin is not designed to face the internet directly: serve it over HTTPS from a reverse proxy, and enter the proxy's address under Networking > Known Proxies. Without it Jellyfin discards X-Forwarded-For, sees every client as the proxy and remote-access limits do not apply. [6][7][12]
Clients sometimes send api_key in the URL, so do not keep full request URLs in the proxy's access log. The container runs as root; the docs' user: uid:gid option is not in the template. [1][7]

Backup

Everything Jellyfin owns is in the config volume: stop the container and copy it, or use Dashboard > Backups (since 10.11) for a live zip. Built-in backups are written to /config/data/backups, need 5 GB free and restore only on the system that made them, so copy them off the server. [15]
The cache volume can be rebuilt and is marked with CACHEDIR.tag since 12.0, so backup tools can skip it. Back up the media library separately: Jellyfin's backup holds metadata, not the files. [15][20]