Sign inSign up

ppaslan/plex

By ppaslan

•Updated 3 days ago

Image
0

5.5K

ppaslan/plex repository overview

⁠Plex Media Server

Hardened Plex Media Server image — no s6-overlay, non-root, read-only root filesystem.

⁠Features

  • Runs as non-root (USER 1000:1000 default, overridable)
  • readOnlyRootFilesystem compatible
  • No init system — PMS runs as PID 1
  • First-run setup with PLEX_CLAIM token support
  • Hardware transcoding: NVIDIA (via container toolkit) and Intel QSV/VAAPI (via /dev/dri)
  • Multi-arch: amd64, arm64

⁠Environment variables

VariableDescriptionDefault
PLEX_CLAIMClaim token from https://plex.tv/claim⁠ — used on first run only
PLEX_CLAIM_FILEPath to file containing claim token (alternative to PLEX_CLAIM)
ADVERTISE_IPCustom connection URL (e.g. https://plex.example.com:443)
ALLOWED_NETWORKSComma-separated (no spaces) IP/CIDR ranges that bypass Plex account auth — clients are granted admin access
PLEX_MEDIA_SERVER_APPLICATION_SUPPORT_DIROverride config path/config/Library/Application Support
PLEX_MEDIA_SERVER_MAX_PLUGIN_PROCSMax plugin processes6
PLEX_RELAY_ENABLEDEnable Plex Relay (bypasses reverse proxy)0
PLEX_MANUAL_PORT_MAPPINGDisable UPnP/NAT-PMP (1=manual, 0=auto)1
PLEX_GDM_ENABLEDEnable GDM network discovery0
PLEX_PUBLISH_SERVERRegister server with plex.tv for remote access1
PLEX_SECURE_CONNECTIONSRequire HTTPS (1=prefer, 2=require)1

⁠Volumes

PathPurpose
/configPersistent data — preferences, databases, metadata
/transcodeTemporary transcoding files
/tmpGeneral temporary files

⁠Docker Compose

services:
  plex:
    image: ppaslan/plex:latest
    restart: unless-stopped
    user: "1000:1000"
    read_only: true
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    environment:
      - PLEX_CLAIM=claim-xxxx
      - ADVERTISE_IP=https://plex.example.com:443
      - NVIDIA_VISIBLE_DEVICES=all
    ports:
      - "32400:32400"
    runtime: nvidia
    volumes:
      - ./config:/config
      - /media:/media:ro
    tmpfs:
      - /tmp:size=128m
      - /transcode:size=20g
    # Intel GPU — use instead of runtime: nvidia + NVIDIA_VISIBLE_DEVICES
    # devices:
    #   - /dev/dri:/dev/dri
    # group_add:
    #   - "104"  # render group GID

⁠Kubernetes

spec:
  runtimeClassName: nvidia  # remove for Intel GPU
  securityContext:
    runAsUser: 1000
    runAsGroup: 1000
    runAsNonRoot: true
    fsGroup: 1000
    fsGroupChangePolicy: OnRootMismatch
    seccompProfile:
      type: RuntimeDefault
  containers:
    - name: plex
      image: ppaslan/plex:latest
      securityContext:
        readOnlyRootFilesystem: true
        allowPrivilegeEscalation: false
        capabilities:
          drop: [ALL]
      resources:
        limits:
          nvidia.com/gpu: 1  # or gpu.intel.com/i915: 1
      volumeMounts:
        - name: config
          mountPath: /config
        - name: transcode
          mountPath: /transcode
        - name: tmp
          mountPath: /tmp
  volumes:
    - name: config
      persistentVolumeClaim:
        claimName: plex-config
    - name: transcode
      emptyDir:
        sizeLimit: 20Gi
    - name: tmp
      emptyDir:
        medium: Memory
        sizeLimit: 128Mi
⁠Hardware transcoding

Requires GPU drivers on the nodes and the corresponding device plugin deployed to the cluster:

Set runtimeClassName: nvidia for NVIDIA or remove it for Intel, and adjust the resource limit accordingly.

⁠Building

docker buildx build \
  --platform linux/amd64,linux/arm64 \
  --build-arg PLEX_VERSION=1.43.1.10611-1e34174b1 \
  -t dhi.io/plex:1.43.1.10611-1e34174b1 \
  -t dhi.io/plex:latest \
  images/plex/

Tag summary

Content type

Image

Digest

sha256:23f0ce527…

Size

124.1 MB

Last updated

3 days ago

docker pull ppaslan/plex