dank
183a6d5442
A Plex section scan walked 50k files at ~850 r/s and nothing bounded it. `IOWeight=` in a quadlet looks like the fix and does nothing: systemd delegates `cpu memory pids` to user@.service and NOT io, and it drops a resource line it cannot honour without a word — the container boots healthy and its cgroup has no io.weight file at all. Same family as RequiresMountsFor= (inert in the user manager) and ConditionPathIsMountPoint= (fail-dead). Place the two system drop-ins that make the controller reachable (user.slice IOAccounting=yes puts io in user.slice/cgroup.subtree_control, measured immediately; user@1000.service DelegateControllers gains io and lands at the next reboot, because restarting the user manager would kill every rootless container on the host), then ask for the share: IOWeight=10 on jellyfin and plex. 10 is a convention, not a measured optimum — proportional share, only bites under contention, only requirement is far below the default 100. ensure_user_io_delegate places both from git and prints NOTE: io is not delegated … inert until the next reboot, so the quadlet line never reads as live config. Verified on the host: subtree_control flipped to `cpu io memory pids`, the drop-in is attached and parsed (systemctl cat), and the podman 5.7 generator emits IOWeight=10 for both units (bare key; UnitConfigItem= not needed). Two limits recorded instead of hidden: a container's weight covers its whole cgroup (scan and playback share it), and the comparison happens inside user.slice, so it cannot push a rootless unit below a root unit such as frank-archon — that pairing is user.slice's own weight, a separate call. Docs: Quadlet Lifecycle 4b (the three-command read of the chain), Pi-hole (all rootless containers share one 10.0.2.100, so one chatty container throttles DNS for the host — 8 events today), E2E Suite gotcha 7 (the gate depends on the runner's resolver: 21 reds on a lost wired link, 37/37 minutes later). Seam: an in-repo IOWeight= may only exist when both drop-ins exist AND the deployer places them. ./tests/run.sh: 789 ok, exit 0.
74 lines
3.1 KiB
INI
74 lines
3.1 KiB
INI
# Quadlet unit: Jellyfin media server (rootless, boot-persistent).
|
|
#
|
|
# Install path on dankserver: ~/.config/containers/systemd/jellyfin.container
|
|
# Unit name: jellyfin.service (podman 5.x drops the container- prefix)
|
|
#
|
|
# Data roots migrated from /opt/jellyfin to /home/dank/Containers/jellyfin at
|
|
# cutover. The library is seen through /var/lib/media-meta/view, the SSD-backed
|
|
# overlay view (scripts/media-view.sh): the array stays read-only and untouched,
|
|
# while the sidecars this server writes land on the NVMe. Every
|
|
# creation-time environment variable of the compose-era container is kept as
|
|
# an Environment= line (zero drift); none of them are secrets, so this unit
|
|
# needs no EnvironmentFile.
|
|
|
|
[Unit]
|
|
Description=Jellyfin media server container
|
|
After=network.target
|
|
|
|
[Container]
|
|
ContainerName=jellyfin
|
|
Image=ghcr.io/jellyfin/jellyfin:latest@sha256:fea863d0cd9ec445985d9c75fc6ed64e38a1d2766cf0c250a33d553f4fc1b771
|
|
Network=dankserver_appnet
|
|
Environment=DEBIAN_FRONTEND=noninteractive
|
|
Environment=DOTNET_SYSTEM_IO_DISABLEFILELOCKING=true
|
|
Environment=JELLYFIN_CACHE_DIR=/cache
|
|
Environment=JELLYFIN_CONFIG_DIR=/config/config
|
|
Environment=JELLYFIN_DATA_DIR=/config
|
|
Environment=JELLYFIN_FFMPEG=/usr/lib/jellyfin-ffmpeg/ffmpeg
|
|
Environment=JELLYFIN_LOG_DIR=/config/log
|
|
Environment=JELLYFIN_PublishedServerUrl=http://192.168.0.235:8096
|
|
Environment=JELLYFIN_WEB_DIR=/jellyfin/jellyfin-web
|
|
Environment=LANG=en_US.UTF-8
|
|
Environment=LANGUAGE=en_US:en
|
|
Environment=LC_ALL=en_US.UTF-8
|
|
Environment=LD_PRELOAD=/usr/lib/jellyfin/libjemalloc.so.2
|
|
Environment=MALLOC_TRIM_THRESHOLD_=131072
|
|
Environment=NVIDIA_DRIVER_CAPABILITIES=compute,video,utility
|
|
Environment=NVIDIA_VISIBLE_DEVICES=all
|
|
Environment=XDG_CACHE_HOME=/cache
|
|
PublishPort=8096:8096
|
|
PublishPort=8920:8920
|
|
PublishPort=7359:7359/udp
|
|
PublishPort=1900:1900/udp
|
|
Volume=/home/dank/Containers/jellyfin/config:/config
|
|
Volume=/home/dank/Containers/jellyfin/cache:/cache
|
|
# The view, writable: Jellyfin is the metadata writer (movie.nfo / tvshow.nfo /
|
|
# episode.nfo + artwork) and those bytes belong on the SSD. The gate in [Service]
|
|
# is the guard: started against a plain, unmounted view directory a scan decides
|
|
# the library is empty and deletes what it cannot see.
|
|
Volume=/var/lib/media-meta/view:/data
|
|
AddDevice=/dev/dri
|
|
GroupAdd=keep-groups
|
|
HealthCmd=curl -f http://localhost:8096/health
|
|
HealthInterval=30s
|
|
HealthTimeout=10s
|
|
HealthRetries=3
|
|
|
|
[Service]
|
|
# Refuse to start until the bind source is a real mount — see the header of
|
|
# scripts/wait-for-mount.sh for the blind-boot incident this prevents.
|
|
ExecStartPre=/home/dank/serverAppConfigs/scripts/wait-for-mount.sh /var/lib/media-meta/view /mnt/entropy
|
|
Restart=always
|
|
RestartSec=5
|
|
|
|
# A library scan reads the array for minutes on end. Weighted LOW (default is
|
|
# 100) so that when the array is contended a scan loses to playback and to every
|
|
# other container this user runs. Proportional share, not a cap: it changes
|
|
# nothing while the disk is idle. 10 is a convention — the requirement is only
|
|
# that it sit far below 100 — and it is inert until user@1000.service is
|
|
# delegated the io controller ([[Quadlet Lifecycle]]).
|
|
IOWeight=10
|
|
|
|
[Install]
|
|
WantedBy=default.target
|