Bazarr on PMSS

Bazarr finds and downloads subtitles for the films and series that Sonarr and Radarr manage, from the subtitle providers you enable. On a Pulsed Media seedbox it runs in rootless Docker at your own address, behind its own login; it used about 486 MiB of memory a minute after start. The steps below write that login into Bazarr's config before the container first starts, so it is never up without one. Tested on a Pulsed Media seedbox on 24 October 2026 with lscr.io/linuxserver/bazarr v1.6.2-ls369.

Bazarr's login page at /user-USERNAME/bazarr/ in the 24 October 2026 test.

Privacy

Level: MEDIUM. Using Bazarr reduces your privacy. What leaves your account, from Bazarr's source code on GitHub (read on the master branch, not at the tested v1.6.2 tag):

• By default Bazarr sends an event to Google Analytics each time it downloads a subtitle or a provider throttles it: the provider, the language, the action, a random install id, and the versions of Bazarr, Sonarr, Radarr, Python and the operating system (bazarr/utilities/analytics.py; on by default in bazarr/app/config.py). Step 1 writes analytics: enabled: false, and per the source no event is sent when it is off. The test confirmed the setting stayed off; network traffic was not captured. Bazarr still creates its random install id file, config/analytics_visitor_id.txt, with analytics off.
• The subtitle providers you enable see which titles and files you search subtitles for. The main providers need an account of your own, which ties those searches to you.
• Bazarr's source checks GitHub's releases API for updates (bazarr/app/check_update.py). This image starts Bazarr with --no-update; whether the check still runs was not determined.
• Bazarr fetches its announcements feed from cdn.jsdelivr.net or raw.githubusercontent.com (bazarr/app/announcements.py).
• Bazarr's login cookie is named session, is set for the whole server address rather than your path, and has no Secure or SameSite flag. Your browser therefore also sends your Bazarr session with requests to other paths on the same server name, including other accounts' apps you open there, and the cookie can clash with another app that uses a cookie of the same name. A clash was not tested.

Requirements

Need	Bazarr on PMSS
Memory	486 MiB about one minute after start with no series or films connected, measured on a test account with a 4000 MiB memory limit. Check your own limit and use with userShowLimits (UserShowLimits on PMSS).
Disk and file quota	The image counts toward your disk and file quota. The test measured the Bazarr and Lidarr images together, not separately: 24,763 files and 910 MB for the whole test account. Check yours with quota -s.
Own login	Yes, a login form. Written into the config in step 1, before the first start.
Address	https://SERVER/user-USERNAME/bazarr/ through your own web server. Bazarr's Base URL setting carries the path, so the proxy fragment needs no map-urlpath.
Sonarr and Radarr	Bazarr reads your series and films from them. In the test a stand-in container named sonarr on the same Docker network was reachable by name; Bazarr could not reach programs on the server's own 127.0.0.1, where the Install Media Stack apps run. No route was tested with real Sonarr or Radarr. See Integrate.
Other apps	An account at each subtitle provider that requires one.

Install

Replace USERNAME with your account name, SERVER with your server's name as it appears in your panel address, and PORT with a free port between 2000 and 38000 that ss -tln does not list. Other accounts on the same server can connect to 127.0.0.1, which is why the login goes into the config before the port exists.

1. Make the folders, a random password and the config with the login in it. Run this step once: running it again after Bazarr has started replaces the config, with its settings and providers, and makes a new password. Bazarr stores the password as an MD5 hash, so the config holds the hash, not the password. The test used the login type form. Per Bazarr's source, basic makes Bazarr ask for an HTTP login of its own, which collides with your panel login; that was not tested.

cd ~
mkdir -p ~/docker/bazarr/config/config ~/movies ~/tv
chmod 700 ~/docker/bazarr
umask 077
openssl rand -base64 24 | tr -d '\n' > ~/docker/bazarr/login.pw
printf 'PUID=0\nPGID=0\nTZ=Etc/UTC\n' > ~/docker/bazarr/bazarr.env
cat > ~/docker/bazarr/config/config/config.yaml <<EOF
general:
  base_url: /user-USERNAME/bazarr
analytics:
  enabled: false
auth:
  type: form
  username: admin
  password: $(tr -d '\n' < ~/docker/bazarr/login.pw | md5sum | cut -d' ' -f1)
  apikey: $(openssl rand -hex 16)
EOF
chmod 600 ~/docker/bazarr/bazarr.env ~/docker/bazarr/login.pw ~/docker/bazarr/config/config/config.yaml

admin is the login name used in the test. PUID=0 and PGID=0 make the files Bazarr writes belong to your own account.

2. Create the shared Docker network if it does not exist yet. Containers on the same network reach each other by name; see Integrate.

docker network inspect pmss-media >/dev/null 2>&1 || docker network create pmss-media

3. Start Bazarr with its port on 127.0.0.1. The image is pinned to the digest that was tested.

docker run -d --name bazarr --network pmss-media --env-file ~/docker/bazarr/bazarr.env \
  -p 127.0.0.1:PORT:6767 \
  -v ~/docker/bazarr/config:/config -v ~/movies:/movies -v ~/tv:/tv \
  --restart unless-stopped \
  lscr.io/linuxserver/bazarr@sha256:946dc8c5bb5331418eac60050cf40a63cb8f66ac039841dda493870e3559799c

Bazarr needs about 30 seconds before it answers.

4. Add the proxy fragment as ~/.lighttpd/custom.d/bazarr.conf, with your USERNAME and PORT:

$HTTP["url"] =~ "^/user-USERNAME/bazarr(/|$)" {
  auth.require = ()
  setenv.set-request-header = ( "Authorization" => "" )
  proxy.server = ( "" => ( (
    "host" => "127.0.0.1",
    "port" => PORT
  ) ) ),
  proxy.header = ( "upgrade" => "enable" )
}

auth.require = () lets requests past your panel login to Bazarr's own login. The setenv.set-request-header line removes your panel login, which a browser logged into your panel sends with every request, before the request reaches Bazarr (Lighttpd Custom Configuration explains the line). With the form login from step 1 Bazarr does not need it, and the login worked with the line in place in the test. "upgrade" => "enable" passes WebSocket connections through; Bazarr itself refuses them and falls back to polling (see Troubleshooting), so the line does no harm. Then check the syntax from your home folder:

cd ~ && /usr/sbin/lighttpd -t -f ~/.lighttpd.conf

It prints Syntax OK. Your web server picks the file up within about a minute (Lighttpd Custom Configuration); in the test that took about 40 seconds, and the address answered 500 or 502 until Bazarr was ready.

Configure

• Open https://SERVER/user-USERNAME/bazarr/ and log in as admin with the password from cat ~/docker/bazarr/login.pw. Settings → Application → General shows the Base URL and the Form login from step 1.
• Inside the container your films are /movies (~/movies) and your series /tv (~/tv). Matching these paths to the ones Sonarr and Radarr report was not tested. To map other folders, change the left side of the -v lines in step 3, then docker rm -f bazarr and run step 3 again; that variant was not tested.
• Subtitle providers are added under Settings → Providers. Read the Privacy section first.
• After the first start Bazarr rewrites config.yaml with mode 644. Other accounts still cannot read it, because ~/docker/bazarr is 700; the file then also holds the API key and the password hash.
• Updating: this image starts Bazarr with in-app updates switched off. The digest keeps you on the tested build; to move to a newer one, pull the image, read its digest, then run docker rm -f bazarr and step 3 with the new digest. Updating was not tested.

docker pull lscr.io/linuxserver/bazarr:latest
docker image inspect lscr.io/linuxserver/bazarr:latest --format '{{index .RepoDigests 0}}'

Integrate

Connecting real Sonarr and Radarr instances was not tested; the account had neither installed. What was measured on the test server:

• A listener on the server's own 127.0.0.1 could not be reached from inside the Bazarr container at any address tried: 127.0.0.1, 172.17.0.1, 10.0.2.2 and host.docker.internal. Sonarr and Radarr from Install Media Stack listen on the server's 127.0.0.1 (as that page documents), so no route from Bazarr to them is known.
• A stand-in container named sonarr on the pmss-media network was reachable from Bazarr at http://sonarr:8989/. The docker-install-lsio helper in your ~/bin (Rootless DOCKER) names its Sonarr and Radarr containers sonarr and radarr and puts them on this network.

For Sonarr and Radarr containers on that network, the settings are under Settings → Library → Sonarr and Settings → Library → Radarr: the address is sonarr or radarr, the port 8989 or 7878, and the API key is the one from that app. If the app has a URL base, enter it in Bazarr's Base URL field for that app.

Test

1. docker ps --filter name=bazarr shows the container as Up, and docker logs bazarr shows "BAZARR is started and waiting for requests".
2. https://SERVER/user-USERNAME/bazarr/ shows Bazarr's login page. A wrong password is refused.
3. stat -c '%a %n' ~/docker/bazarr ~/docker/bazarr/bazarr.env ~/docker/bazarr/login.pw showed 700, 600 and 600 in the test.
4. Requests without a login straight to the port are refused, which is what another account on the server sees:

curl -s -o /dev/null -w '%{http_code}\n' http://127.0.0.1:PORT/user-USERNAME/bazarr/api/system/status
curl -s -o /dev/null -w '%{http_code}\n' http://127.0.0.1:PORT/user-USERNAME/bazarr/api/series

In the test both returned 401, through the panel address too, and the first also for a request carrying only the panel login. Of the addresses tried, only the login page itself, /api/system/ping and the API description page /api/ answered without a login; the login page does not contain the API key.

Uninstall

docker rm -f bazarr
rm -f ~/.lighttpd/custom.d/bazarr.conf
touch ~/.lighttpd/custom
docker image rm lscr.io/linuxserver/bazarr@sha256:946dc8c5bb5331418eac60050cf40a63cb8f66ac039841dda493870e3559799c

Deleting a fragment changes no remaining file, so touch ~/.lighttpd/custom makes your web server restart without it (deleting or disabling a fragment). Remove the network with docker network rm pmss-media only if no other container uses it; the Sonarr and Radarr containers from docker-install-lsio share it.

Deleting the data is your choice. rm -rf ~/docker/bazarr deletes the login file, the config with the API key and password hash, and Bazarr's database. rmdir ~/movies ~/tv removes those folders only if they are empty, so folders that hold files are not touched. The removals in this section, apart from the touch, were run in the test.

Troubleshooting

• The address answers 500 or 502 right after the start: Bazarr needs about 30 seconds before it answers; in the test this cleared by itself. If it stays, read docker logs bazarr.
• The syntax check prints "cannot change directory" and then a parser error: it was run from another folder. Run cd ~ first; this was seen in the Lidarr test on the same server.
• The browser console shows a failed WebSocket connection to /api/socket.io/: Bazarr's own server refuses WebSocket upgrades, also when reached directly on its port. The page falls back to polling and works; in the test it did.
• Bazarr cannot connect to Sonarr or Radarr: see Integrate. A container could not reach the server's 127.0.0.1 in the test.
• docker pull or docker run fails before Bazarr starts: see the troubleshooting section of Rootless DOCKER.

Rootless Docker, which this guide runs on, is installed on all Pulsed Media servers (Pulsed Media Seedbox and Storage Features); the seedbox plans list what each includes.

See also

• Install Media Stack — Sonarr, Radarr, Prowlarr and Jellyfin, installed by PMSS
• Self-Hosted Apps on PMSS — more applications for rootless Docker, with their path settings and login defaults
• Lighttpd Custom Configuration — proxy fragments and what each line does
• Rootless DOCKER — running containers in your account, and the docker-install-lsio helper
• Seedbox — Pulsed Media seedbox plans