TPTito Pinardo Gutiérrez
← Back to the rack
Español
1U · PLEXPlex · GTX 1050 Ti · NVENC In production

Slot 12 of 25 in the rack · In production

1U unit · Media

Plex · with the GPU inside

The household's priority

The home media server. When the TV or a phone can't play a format, Plex converts it on the fly on a GTX 1050 Ti that the container sees as its own, without loading the server's CPU.

Why a GPU
Converting 4K on the CPU saturates several cores. With the GPU, the same work uses a fraction of one.
How the GPU gets there
The driver lives on the hypervisor and the container receives its devices. Since September, in an unprivileged container with exactly the group mapping it needs.
The hard part
Keeping it working after every kernel or driver update: twice it broke without anything saying so.
  • ~30 %of one core for a 4K stream converted on the GPU
  • 3,295files checked looking for AV1
  • 12films converted to HEVC
  • 0Plex restarts to fix the GPU the second time

Its code, in the open Public version of the repo: no IPs or secrets.

Inside the media

A film can arrive as it is or be converted on the fly on the GPU. Pick a flow.

Flows Pick one and follow the packet.

Outside Plex container · Proxmox unprivileged, with the GPU inside Watch Convert on the fly The GPU, from hypervisor to container The library The TV Router Phone outside Traefik GTX 1050 Ti ZFS pool Plex Direct Sessions Update Decode Encode CPU Detection IOMMU NVIDIA driver Devices Unprivileged Library Scan Conversion Live TV
Hermesvisiting the unit

Click a part or pick a flow. If you came from a skill, the parts where I use it are already lit.

      A film on the TV
      1. The home TV — The TV asks for a film.
      2. Router — The router lets it reach Plex: its only exception.
      3. Plex Media Server — Plex looks up the file.
      4. Library — In the library.
      5. Storage — The pool reads it.
      6. Library — Back to Plex.
      7. Direct play — The TV understands the format: direct play, nothing converted.
      8. The home TV — And it plays.
      The same film, away from home
      1. The phone, away from home — From my phone, on mobile data, I ask for the same film.
      2. Traefik — It comes in through Traefik.
      3. Plex Media Server — Plex sees it needs lower quality.
      4. Decoding (NVDEC) — The GPU decodes the original.
      5. GTX 1050 Ti — All the heavy lifting stays on the GPU.
      6. Encoding (NVENC) — And encodes it at the quality the connection can take.
      7. Sessions — The session shows it's on hardware.
      8. The phone, away from home — And it reaches the phone without loading the server's CPU.
      Files nothing at home could play
      1. Codec scan — A library scan looks up each file's codec.
      2. Library — 14 show up in AV1; two pairs were the same file linked twice: 12 films.
      3. Library conversion — They're converted one by one.
      4. CPU, when there's no choice — The CPU decodes AV1, because this GPU can't.
      5. Encoding (NVENC) — The GPU encodes 10-bit HEVC, keeping HDR.
      6. GTX 1050 Ti — The encoding work, on the GPU.
      7. Library — The result replaces the original.
      8. Plex Media Server — And Plex plays it on any device at home.
      The GPU reaches the container
      1. IOMMU and boot — The hypervisor boots with IOMMU on.
      2. Driver on the hypervisor — It loads the NVIDIA driver, at its pinned version.
      3. GTX 1050 Ti — The GPU is ready.
      4. GPU devices — Its devices are passed into the container with their exact numbers.
      5. Unprivileged container — Unprivileged: only the video group matches the hypervisor's.
      6. Plex Media Server — Plex starts.
      7. Hardware detection — And detects the GPU. If it wasn't there at start-up, it won't see it until restarted.
      I update Plex
      1. Update — I install the new version inside the container.
      2. Plex Media Server — Plex starts and migrates its database.
      3. Hardware detection — I check it detects the GPU.
      4. GTX 1050 Ti — And that a test conversion runs on hardware.

      1. The home TV

        On the Wi-Fi segment, with a firewall exception for Plex only.

      2. Router

        Lets the TV reach Plex and nothing else on the server.

        • VLANs

      3. The phone, away from home

        On a worse connection, it usually needs converting.

      4. Traefik

        The way in from outside.

        • Traefik

      5. GTX 1050 Ti

        A modest GPU that encodes H.264 and HEVC in hardware, including 10-bit HEVC with HDR. It can't decode AV1.

      6. Storage

        The library lives on a multi-disk ZFS pool.

        • ZFS

      7. Plex Media Server

        The server, updated from the beta channel because the public repo lags behind.

        • Linux (Debian, Alpine, Arch)

      8. Direct play

        If the device understands the format, the file goes out as it is: no GPU, no CPU.

      9. Sessions

        Every playback in progress, with its conversion command. That's where you see whether it's on GPU or software.

      10. Update

        Beta-channel package, installed inside the container and checked: version, GPU detected and database migration done.

        • Linux (Debian, Alpine, Arch)

      11. Decoding (NVDEC)

        The GPU decompresses the original video.

      12. Encoding (NVENC)

        And compresses it again to the format and quality the device asks for.

      13. CPU, when there's no choice

        Whatever the GPU can't do (decode AV1) falls to the CPU.

      14. Hardware detection

        Plex checks its hardware once and remembers. If the GPU comes back later, it won't notice until restarted.

      15. IOMMU and boot

        Kernel parameters so the GPU gets its own group and can be assigned.

        • Proxmox VE
        • Linux (Debian, Alpine, Arch)

      16. Driver on the hypervisor

        The version is pinned on purpose: every new kernel is a chance for it to stop compiling.

        • Linux (Debian, Alpine, Arch)

      17. GPU devices

        The hypervisor's device files are passed into the container, with their exact numbers.

        • LXC

      18. Unprivileged container

        Only the video group is mapped one to one; the rest is shifted. Root in the container isn't root on the server.

        • LXC
        • Linux / SSH hardening

      19. Library

        Films and series on the pool, with access time disabled to save writes.

        • ZFS

      20. Codec scan

        A walk through the library with ffprobe to find each file's codec.

        • Linux (Debian, Alpine, Arch)

      21. Library conversion

        What no device at home can play is converted once and for all.

        • Linux (Debian, Alpine, Arch)

      22. Live channels

        Public free-to-air channels with their guide, served by the live TV unit.

      What I use from my skill tree

      Pick a skill: the parts where I use it light up on the map and I tell you what for.

      Terraform
      Creates the Plex container.
      Proxmox VE
      IOMMU, the GPU driver on the hypervisor and the permissions the container can't touch.
      LXC
      An unprivileged container with the GPU's devices passed in and the video group mapped one to one.
      ZFS
      The library on a ZFS pool, with access time disabled.
      Linux (Debian, Alpine, Arch)
      Pinned driver, ffmpeg and ffprobe to review and convert the library, and per-user checks.
      VLANs
      The TV sits on the most isolated segment, with an exception for Plex only.
      Traefik
      The way into Plex from outside home.
      Linux / SSH hardening
      An unprivileged container and a single network exception for the TV.

      Incident log

      Real failures. Read the symptom, pick the cause you think it was and see how it was fixed.

      1. #1

        The GPU was fine, but Plex didn't use it

        21-07-2026 · transcoding

        After fixing the devices, decoding was on the GPU again, but encoding stayed on the CPU. I even tried lifting the driver's session limit: nothing.

        What do you think was going on?

        Show the fix
        Cause
        Plex detects hardware once and remembers it while the process lives. When it started the GPU wasn't available, and fixing it underneath didn't make it look again.
        Fix
        Restart Plex at a moment when nobody was watching anything. The next conversion ran fully on the GPU.
        Lesson
        Fixing the layer below isn't enough if the layer above kept the broken state. You have to know what's cached and when it's checked again.

      2. #2

        The GPU vanishes from the container

        July 2026 · driver

        After a run of driver updates with a new kernel, Plex went back to converting everything on the CPU. On the hypervisor the GPU worked.

        What do you think was going on?

        Show the fix
        Cause
        The GPU's devices are created when the driver starts, with specific numbers. The ones the container saw didn't match the hypervisor's real ones after the change.
        Fix
        The second time it happened, without restarting Plex: recreate the devices inside the container with the same numbers as the hypervisor. And check with a five-frame conversion as the Plex user.
        Lesson
        Know how to really check something runs on hardware: the session's command, the process's CPU and the devices it has open.

      3. #3

        Films that couldn't be watched

        06-08-2026 · formats

        Some films didn't play well on any device at home, not even when converted on the fly.

        What do you think was going on?

        Show the fix
        Cause
        The GTX 1050 Ti predates hardware AV1 decoding. On the fly, the CPU alone couldn't keep up with 4K in real time.
        Fix
        Convert those 12 films once: decode on the CPU and encode 10-bit HEVC on the GPU, keeping HDR. Checked against the library manager's list.
        Lesson
        If an expensive job would be repeated on every playback, do it once and keep it.

      4. #4

        Deleting from Plex didn't work

        19-09-2026 · permissions

        After moving Plex to an unprivileged container, deleting content from its interface failed. And not even the container's root could fix the permissions.

        What do you think was going on?

        Show the fix
        Cause
        Some folders lacked group write permission. And in this container only the video group matches the hypervisor's: root inside can't change files it doesn't own.
        Fix
        Grant the group permission from the hypervisor, only on the folders that needed it, and test creating and deleting as the Plex user. Without stopping Plex.
        Lesson
        An unprivileged container is safer precisely because its root can't do everything. That changes where things get fixed.

      How it was built

      1. Spring 2026

        A GPU for Plex

        • GTX 1050 Ti with its own IOMMU group and the driver on the hypervisor.
        • Hardware conversion in the Plex container.

      2. July 2026

        The driver saga

        • Driver pinned to a version that builds with the new kernel.
        • Devices and detection fixed, and a reliable way to check it.

      3. August and September 2026

        Library and new container

        • AV1 converted to HEVC.
        • Plex in an unprivileged container managed with Terraform.

      Decisions (and why)

      • Which GPU

        A modest one, for conversion

        Converting video doesn't need compute power but the encoding block, and a small GeForce has it.

      • Privileged or not

        Unprivileged, with just the right mapping

        Privileged makes everything easier, but the container's root would be the server's. Without it, only the video group is shared.

      • The driver

        Pinned, not the latest

        Plex is the most used thing at home. A version that works with the current kernel is worth more than a newer one that might not build.

      What I learned

      • Check on real hardware, not on what the panel says.
      • Know what each layer caches and when it checks again.

      What's next

      • A GPU with AV1 decoding, to stop converting the library.
      • Move the driver to a signed repository as current APT policy requires.

      Shall we talk?

      I can walk through any of these decisions in detail in an interview.

      Download CV Get in touch ← Back to the rack

      Rebuilt from my documentation: no addresses, paths, titles or anything from the library.