Automatically update ffmpeg5 -> ffmpeg6 in jellyfin docker container
reddit / selfhosted

----------------------------------------------------------------------
QuickYogurt2037 · 2023-10-08 08:51

Hello, I'm trying to automatically update ffmpeg5 to ffmpeg6 in the
official jellyfin docker container, best without modifying the
official Dockerfile.

Currently I use the command `sudo docker exec -u 0 -it jellyfin bash
-c 'apt update && apt install jellyfin-ffmpeg6 -y'` to manually update
ffmpeg once I restart jellyfin container.

My `docker-compose.yml` file looks like this:

    version: '3'
    services:
      jellyfin:
        container_name: jellyfin
        image: jellyfin/jellyfin:latest
        user: 133:100
        restart: always
        ports:
          - 8096:8096
        environment:
          - JELLYFIN_CACHE_DIR=/var/cache/jellyfin
          - JELLYFIN_CONFIG_DIR=/etc/jellyfin
          - JELLYFIN_DATA_DIR=/var/lib/jellyfin
          - JELLYFIN_LOG_DIR=/var/log/jellyfin
          - TZ=Europe/Berlin
        volumes:
          - /etc/jellyfin:/etc/jellyfin
          - /var/cache/jellyfin:/var/cache/jellyfin
          - /var/lib/jellyfin:/var/lib/jellyfin
          - /var/log/jellyfin:/var/log/jellyfin
          - /mnt/storage:/mnt/storage:ro

I've also played around with modifying the entrypoint in the `docker-
compose.yml` file, but that doesnt seem to work as the container is
run as uid 133 (user jellyfin on host) which was the old user id of my
non-docker jellyfin instance. This uid doesnt have the necessary
permissions to run apt update/install commands in the container. And I
don't want to run the container as root... I appreciate any help,
maybe someone has clue.

----------------------------------------------------------------------
ElevenNotes · 2023-10-08 12:09

You have broken the first law of containers: Never update software
within a container. If you need a different version of a library,
create your own container image from the parent one. Building
container images is fun and you have more control. You do not need to
reinvent the wheel, you can use the official container as a base layer
and then add the libraries you need on top of it. If you need an
example [here](https://github.com/11notes/docker-paperless-
ngx/blob/main/amd64.dockerfile) is one from myself for paperless-ngx.

----------------------------------------------------------------------
QuickYogurt2037 · 2023-10-08 13:44

Thanks, I guess that will be the way!

----------------------------------------------------------------------
ElevenNotes · 2023-10-08 13:46

You'll see, after creating your first own container image, you want to
build more and more yourself to have more control or switch stuff or
add defaults (like TLS/SSL encryption).

----------------------------------------------------------------------
QuickYogurt2037 · 2023-10-08 13:53

Thanks again, that was quick:

```
FROM jellyfin/jellyfin:latest
USER root
RUN apt-get update \
 && apt-get install -y jellyfin-ffmpeg6
```

Works as intended!

----------------------------------------------------------------------
ElevenNotes · 2023-10-08 14:10

Perfect. Next step would be to get rid of root and run the container
as its own user.

----------------------------------------------------------------------
QuickYogurt2037 · 2023-10-08 14:19

I think I'm doing that already, check the docker-compose file in my
initial post. `ps aux | grep jellyfin` confirms that the user running
the process is indeed jellyfin.

----------------------------------------------------------------------
ElevenNotes · 2023-10-08 14:20

To drop from root to another use you have to use "USER jellyfin" as
the last step in your build, but ai doubt jellyfin works as non-root.

----------------------------------------------------------------------
QuickYogurt2037 · 2023-10-10 07:13

According to my research you can set the USER during build-time in
your Dockerfile, but also override it at runtime in docker-compose.yml
or docker run --user . So my container runs indeed as non-root user.

----------------------------------------------------------------------
ElevenNotes · 2023-10-10 07:27

Not really because your container starts as root and then runs as
another user. Try it out on podman or rootless docker. A true rootless
container never starts as root in the first place. That's why people
should start using podman or rootless docker to make sure a container
can never run as root.

----------------------------------------------------------------------
QuickYogurt2037 · 2023-10-10 09:18

Testing showed that it indeed runs as normal user. I cant even install
packages inside the container or modify system files. ¯\_(ツ)_/¯

----------------------------------------------------------------------
ElevenNotes · 2023-10-10 10:50

Yes, but the container doesn't start as root. It drops from root to
the user because the container runtime (docker) runs as root. Do you
not understand the difference there? Try --u with podman, not docker,
on an image that is not by default rootless and see what happens.

----------------------------------------------------------------------
QuickYogurt2037 · 2023-10-10 11:57

No, tbh I don't. What exactly is wrong about starting it as root and
dropping to a unprivilged user? What can go wrong in the "startup
sequence"?

----------------------------------------------------------------------
ElevenNotes · 2023-10-10 12:19

The init script can be hijacked in example. Containers should be run
in a rootless container host, like podman, or rootless docker. Please
learn about this, its important.