SOLVED: Trickplay permission errors

[gpn]

I have my jellyfin instance running on a debian 12 lxc. I have the database stored locally but the media is being served off my nas which is a debian 12 based system. The media plays fine and I have no issues playing anything or updating the metadata of my media.

When trying to generate trickplay images I get permissions errors. Here is what the logs are showing.

Code:

  at System.IO.FileSystem.CreateDirectory(String fullPath, UnixFileMode unixCreateMode)
  at System.IO.Directory.CreateDirectory(String path)
  at Jellyfin.Server.Implementations.Trickplay.TrickplayManager.CreateTiles(IReadOnlyList`1 images, Int32 width, TrickplayOptions options, String outputDir)
  at Jellyfin.Server.Implementations.Trickplay.TrickplayManager.RefreshTrickplayDataInternal(Video video, Boolean replace, Int32 width, TrickplayOptions options, LibraryOptions libraryOptions, CancellationToken cancellationToken)
[2025-02-20 00:54:24.112 +00:00] [INF] Creating trickplay files at 320 width, for "/media/mediaserver/movies/moviefolder/moviename.mkv" [ID: e1150572-794b-761b-b620-cf5d1db860b8]
[2025-02-20 00:54:24.112 +00:00] [INF] Trickplay generation: "/usr/lib/jellyfin-ffmpeg/ffmpeg -loglevel error -threads 1 -i file:\"/media/mediaserver/movies/moviefolder/moviename .mkv\" -an -sn -vf \"fps=0.10000000149011612,setparams=color_primaries=bt709:color_trc=bt709:colorspace=bt709,scale=trunc(min(max(iw\,ih*(a*sar))\,320)/2)*2:trunc(ow/(a*sar)/2)*2,format=yuv420p\" -threads 1 -c:v mjpeg -qscale:v 4 -fps_mode passthrough -f image2 \"/tmp/jellyfin/e624f15e99404d29b9c60b21a743e281/%08d.jpg\""
[2025-02-20 01:07:52.767 +00:00] [INF] WS "192.168.2.x" closed
[2025-02-20 01:08:29.447 +00:00] [INF] WS "192.168.2.x" request
[2025-02-20 01:29:30.610 +00:00] [ERR] Error creating trickplay images.
System.UnauthorizedAccessException: Access to the path '/media/mediaserver/movies/moviefolder/moviename.trickplay' is denied.
---> System.IO.IOException: Permission denied
  --- End of inner exception stack trace ---

I went as far and changing folder and media permissions to 777 just to test if that would fix the problem. I had them set to 775 originally. The NAS is set to automount into the lxc at /media/mediaserver.

As far as I can tell trickplay has never worked.

[gnattu]

This looks like a generic writing permission denied. Does the user jellyfin has write permission to that folder? 777 does not always work on network shares, depending on how you setup that share.

[gpn]

I hate samba permissions sometimes.. hah.

The samba share is mounted with the same user that owns the directory on the samba server. GUID 1005 is the user that is authenticating with with samba and that is the owner of the files where the media is stored.

[gnattu]

I think you need to configure ACLs explicitly with samba to allow extra permissions as it does not translate posix permissions automatically. Can you verify that?

[gpn]

I need to do some research on how to do that. Do you have any suggested reading to start?

edit: the samba/cifs share is running on a debian host (it is actually a unifi nvr that I use a NAS) and the jellyfin lxc is also debian based.

Here is my mount configuration:
//192.168.10.2/private/samba/file/path on /media/mediaserver type cifs (rw,relatime,vers=3.1.1,cache=strict,username=username,uid=0,noforceuid,gid=0,noforcegid,addr=192.168.10.2,file_mode=0755,dir_mode=0755,soft,nounix,serverino,mapposix,rsize=4194304,wsize=4194304,bsize=1048576,echo_interval=60,actimeo=1,closetimeo=1)

[gpn]

OK I fixed it, at least temporarily! I added file_mode=0777 and dir_mode=0777 to my fstab to mount with more permissions. I need to dig into it some more bring the permissions back down as 777 is not the greatest permission to work with. Leaves too much room for errors. But that does tell me more about the problem and it is now working so that is nice.

Now I just need to figure out how to assign more threads to trickplay generation. I have 8 logical processors and I'd like to assign more than 1!