Can't download images. Metadata text downloads fine.

[forsklt]

Text metadata for content downloads properly, images fail to download. Solution I have found is to restart jellyfin (and swag) then images will download as they should, for about 5 minutes then indefinite loading loop. When clicking the cloud icon to download them in the pop up window (images do load) it just stalls and I end up having to refresh the page to get out of the loading loop. Same issue happens with the plugin catalog, will load for the first 5ish min on restart then indefinitely load. I have ipv6 disabled in both jellyfin and OS (omv). I also find my library not updating without a restart.

Running 10.9.10 using Docker Compose


Logs:
[02:56:14] [ERR] [72] Jellyfin.Api.Middleware.ExceptionMiddleware: Error processing request: The request was canceled due to the configured HttpClient.Timeout of 100 seconds elapsing. URL POST /Items/ede8add241426aac41c1fa9417085e0e/RemoteImages/Download.
[02:57:50] [ERR] [50] Jellyfin.Api.Middleware.ExceptionMiddleware: Error processing request. URL POST /Items/b90d04d91707a1ffa9046a32cb323c2a/RemoteImages/Download.
System.Net.Http.HttpRequestException: Error while copying content to a stream.
---> System.IO.IOException: Unable to read data from the transport connection: Connection reset by peer.
---> System.Net.Sockets.SocketException (104): Connection reset by peer
  at System.Net.Sockets.Socket.AwaitableSocketAsyncEventArgs.CreateException(SocketError error, Boolean forAsyncThrow)
  at System.Net.Sockets.NetworkStream.ReadAsync(Memory1 buffer, CancellationToken cancellationToken)
  at System.Net.Security.SslStream.EnsureFullTlsFrameAsync[TIOAdapter](CancellationToken cancellationToken, Int32 estimatedSize)
  at System.Threading.ExecutionContext.RunInternal(ExecutionContext executionContext, ContextCallback callback, Object state)
  at System.Net.Sockets.SocketAsyncEventArgs.TransferCompletionCallbackCore(Int32 bytesTransferred, Memory1 socketAddress, SocketFlags receivedFlags, SocketError socketError)
  at System.Net.Sockets.SocketAsyncEngine.System.Threading.IThreadPoolWorkItem.Execute()
  at System.Threading.ThreadPoolWorkQueue.Dispatch()
  at System.Threading.PortableThreadPool.WorkerThread.WorkerThreadStart()
--- End of stack trace from previous location ---

Appreciate any help let me know if any other information is needed.

[TheDreadPirate]

Did you set any resource constraints on the container?

[forsklt]

No resource constraints on container

[TheDreadPirate]

Can you share your full jellyfin log via pastebin? And your SWAG config (censor your domain).

[forsklt]

logs: https://pastebin.com/gNjRJfZ8
services:
swag:
image: lscr.io/linuxserver/swag:latest
container_name: swag
cap_add:
- NET_ADMIN
environment:
- PUID=1001
- PGID=100
- TZ=US/Eastern
- URL=****
- VALIDATION=http
- SUBDOMAINS=www,tv,request #optional
- CERTPROVIDER= #optional
- PROPAGATION= #optional
- EMAIL=**** #optional
- ONLY_SUBDOMAINS=false #optional
- EXTRA_DOMAINS= #optional
- STAGING=false #optional
volumes:
- /data/swagcertconfig
ports:
- 443:443
- 80:80
restart: unless-stopped

[TheDreadPirate]

You do not have caching enabled in SWAG, correct? Does SWAG produce logs?

Also, it looks like you have DEBUG logging enabled with an extra logging.json file, correct? Can you remove that and directly modify logging.default.json to enable debugging? Starting in 10.9, the way that DEBUG logging works is not the same as our documentation indicates. (Writes on to-do list of documentation to update).

[forsklt]

logs with the right debug: https://pastebin.com/hFY3g9Ut
swag does not produce any useful logs. just the version and 'server ready' is all. looking at swag docs i dont see any mention of caching

[TheDreadPirate]

I looked at the SWAG git and couldn't find anything in the nginx config that would cause this.

When this happens again, can you open a bash shell into both the SWAG container and Jellyfin container and run these commands.

This will open a bash shell into the container. Replace "jellyfin" with "swag" to open a bash shell for that container.

Code:

sudo docker exec -it jellyfin bash

Now we are verifying that the container's networking isn't broken and that it can actually reach TMDB.

Run this command in the container.

Code:

curl -vvv https://image.tmdb.org/t/p/original/uqIVJR1fmkiwpcIsIcV0vxiyY4z.jpg -o /tmp/futurama.jpg
ls -l /tmp/

[forsklt]

% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0* Host image.tmdb.org:443 was resolved.
* IPv6: 2400:52e0:1a00::718:1
* IPv4: 185.93.1.249
* Trying 185.93.1.249:443...
* Connected to image.tmdb.org (185.93.1.249) port 443
* ALPN: curl offers h2,http/1.1
} [5 bytes data]
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
} [512 bytes data]
* CAfile: /etc/ssl/certs/ca-certificates.crt
* CApath: /etc/ssl/certs
0 0 0 0 0 0 0 0 --:--:-- 0:00:51 --:--:--

does not download (both jellyfin and swag same log) ... it can download running outside container on the same user as the containers

[TheDreadPirate]

So it was able to resolve and it was able to connect, but it doesn't look like it got past the client hello.

Are both SWAG and Jellyfin on a bridge network? It looks like SWAG is. Can you switch one or both of them to host networking for testing?

Do you have any unusual network configurations for the bridge network?

---

Also, I've never seen the "cap_add" + "NET_ADMIN" used before. What is it for? I took a look at Docker's documentation, but I'm not sure I've fully wrapped my head around it.