Jackett on PMSS

Jackett answers searches for the indexers you add to it, from 644 built-in indexer definitions, so an indexer that Prowlarr does not support can still be searched from your Pulsed Media seedbox. Prowlarr, which Install Media Stack installs, does the same job and is the better first choice; use Jackett for an indexer Prowlarr lacks. Jackett starts with no password and signs in anyone who reaches it, so the steps below set its admin password before its port exists. It runs in rootless Docker inside your account. Tested on a Pulsed Media seedbox on 24 October 2026 with lscr.io/linuxserver/jackett v0.24.2900: the install, the password and the login were tested; adding an indexer and connecting Sonarr, Radarr or another app were not.

Privacy

Level: MEDIUM. Using Jackett reduces your privacy. What it holds and sends:

The usernames, passwords and cookies of the indexers you add are stored in Jackett's config, in ~/docker/jackett/config, and Jackett contacts those indexers from the server's address. Each indexer sees the searches made through it.
By default Jackett asks GitHub's API for new releases. Step 3 sets UpdateDisabled to true, which stops that check (Jackett source, src/Jackett.Common/Services/UpdateService.cs in the Jackett repository).
No usage reporting was found in Jackett's source.

Requirements

Need	Jackett on PMSS
Memory	167-183 MiB idle in the test, with no indexer added. userShowLimits shows your account's memory use against its limit.
Own login	Yes, an admin password. Jackett ships without one, so step 3 sets it while no port is published.
Address	`https://SERVER/user-USERNAME/jackett/` through your own web server. Jackett's `BasePathOverride` setting carries the path, so the proxy fragment needs no `map-urlpath`.
Other apps	Indexers to add. Sonarr, Radarr and similar apps can use Jackett through its Torznab feeds (not tested); see Integrate.

Install

Run these over SSH as your own account. Replace USERNAME with your account name, SERVER with the server name in your panel address, and PORT with a free port between 2000 and 38000 that ss -tln does not list. Until a password is set, Jackett signs in every visitor, and other accounts on the same server can connect to 127.0.0.1. So it runs first with no published port, gets its password, and only then gets its port.

1. Make the folders and a random password, and start Jackett with no published port. The first run creates Jackett's config file. The image is pinned to the digest that was tested.

mkdir -p ~/docker/jackett/config ~/docker/jackett/downloads && chmod 700 ~/docker/jackett
( umask 077; openssl rand -base64 24 | tr -d '\n=/+' > ~/docker/jackett/admin.pw )
chmod 600 ~/docker/jackett/admin.pw
docker run -d --name jackett -e PUID=0 -e PGID=0 -e TZ=Etc/UTC \
  -v ~/docker/jackett/config:/config -v ~/docker/jackett/downloads:/downloads \
  lscr.io/linuxserver/jackett@sha256:d1b82a9c5bbaea44284a550af739bd838749b72f15b10ef61b6c9d9d1b2f1ed7
ls ~/docker/jackett/config/Jackett/ServerConfig.json

PUID=0 and PGID=0 make the files Jackett writes belong to your own account. If the last line says No such file or directory, Jackett is still starting: wait a few seconds and run it again before step 2.

2. Set the path and switch off update checks. Jackett rewrites its config file when it saves settings, so edit the file only while the container is stopped, then start the same container again, still with no published port.

docker stop jackett
sed -i -E 's|("BasePathOverride": *)null|\1"/user-USERNAME/jackett"|; s|("UpdateDisabled": *)false|\1true|' ~/docker/jackett/config/Jackett/ServerConfig.json
grep -E '"(BasePathOverride|UpdateDisabled)"' ~/docker/jackett/config/Jackett/ServerConfig.json
docker start jackett

The grep shows "/user-USERNAME/jackett" and true.

3. Set the admin password from inside the container. The password goes into a request file in the config folder, a small script sends it from inside the container so it never appears on a command line, and the request file is deleted afterwards.

( umask 077; printf '"%s"' "$(cat ~/docker/jackett/admin.pw)" > ~/docker/jackett/config/pw.json )
cat > ~/docker/jackett/set-password.sh << 'EOF'
B=http://127.0.0.1:9117/user-USERNAME/jackett
curl -sL -c /tmp/cj -b /tmp/cj -o /dev/null $B/UI/Login
curl -s -o /dev/null -w "%{http_code}\n" -b /tmp/cj -X POST -H "Content-Type: application/json" --data-binary @/config/pw.json $B/api/v2.0/server/adminpassword
rm -f /tmp/cj
EOF
docker exec -i jackett sh < ~/docker/jackett/set-password.sh
rm -f ~/docker/jackett/config/pw.json
grep -E '"AdminPassword": *null' ~/docker/jackett/config/Jackett/ServerConfig.json

The docker exec line prints 204 when the password is set. The last line prints nothing once Jackett has stored the password; if it prints "AdminPassword": null, the password is not set, so do not go on to step 4 (see Troubleshooting). Jackett needs the session cookie from the first request before it accepts the second, and it takes the password as a quoted JSON string; the test found both.

4. Start Jackett with its port on 127.0.0.1. The password and settings stay in the config folder.

docker rm -f jackett
docker run -d --name jackett --restart unless-stopped -e PUID=0 -e PGID=0 -e TZ=Etc/UTC \
  -p 127.0.0.1:PORT:9117 -v ~/docker/jackett/config:/config -v ~/docker/jackett/downloads:/downloads \
  lscr.io/linuxserver/jackett@sha256:d1b82a9c5bbaea44284a550af739bd838749b72f15b10ef61b6c9d9d1b2f1ed7

5. Add the proxy fragment and check the syntax. Run the check from your home folder.

cat > ~/.lighttpd/custom.d/jackett.conf << 'EOF'
$HTTP["url"] =~ "^/user-USERNAME/jackett(/|$)" {
  auth.require = ()
  setenv.set-request-header = ( "Authorization" => "" )
  proxy.server = ( "" => ( ( "host" => "127.0.0.1", "port" => PORT ) ) ),
  proxy.header = ( "upgrade" => "enable" )
}
EOF
/usr/sbin/lighttpd -t -f ~/.lighttpd.conf

The last command prints Syntax OK. If it prints an error, fix or delete jackett.conf at once: a broken fragment keeps your web panel down at the next restart.

auth.require = () lets requests past your panel login to Jackett's own login page, and it lets apps that use Jackett's API key reach it without your panel login. setenv.set-request-header removes your panel login, which a browser logged into your panel sends with every request, before the request reaches Jackett; Jackett signs in with its own form and does not need it. In the test the browser login worked with the panel login on every request. Your web server usually picks up the file within about a minute (Lighttpd Custom Configuration); the first fragment of an account can take longer, see Troubleshooting.

What the test ran: the same commands in a different order. The test set the password, as the same three requests piped into docker exec -i jackett sh, before it set the path. This guide sets the path first, so the address the password request uses is already Jackett's own; the steps in this order were not run as one sequence. The ls and grep checks were added for this guide.

Configure

Open https://SERVER/user-USERNAME/jackett/ and sign in with the password that cat ~/docker/jackett/admin.pw shows.
The dashboard shows Jackett's API key, masked. Apps use it to search through Jackett, and anyone with the key can search your indexers, so treat it like a password.
Add indexers with Add indexer. Each indexer's login is stored in ~/docker/jackett/config; keep ~/docker/jackett closed to other accounts (chmod 700, as step 1 sets). Jackett's config file there holds the API key and the password hash.
Updating: with update checks off, Jackett no longer looks for new releases, so updating means a new image. To move to a newer build, pull the image's tag, read the new digest, then run docker rm -f jackett and step 4 with that digest. Updating was not tested.

docker pull lscr.io/linuxserver/jackett:latest
docker image inspect lscr.io/linuxserver/jackett:latest --format '{{index .RepoDigests 0}}'

Integrate

Not tested. Sonarr, Radarr and similar apps add a Jackett indexer as a Torznab feed with Jackett's API key. The test did not run a search; going by Jackett's path and its Torznab route, the address for all configured indexers together would be http://127.0.0.1:PORT/user-USERNAME/jackett/api/v2.0/indexers/all/results/torznab/. Apps that Install Media Stack installs run directly in your account, not in containers, so 127.0.0.1:PORT is the address they would use.

Test

docker ps --filter name=jackett shows the container as Up.
https://SERVER/user-USERNAME/jackett/ leads to Jackett's login page, which asks for the admin password. A wrong password is refused.
The password is stored: grep -E '"AdminPassword": *null' ~/docker/jackett/config/Jackett/ServerConfig.json prints nothing.
A request with no login straight to the port is sent to the login page, which is what another account on the server sees:

curl -s -o /dev/null -w '%{http_code}\n' http://127.0.0.1:PORT/user-USERNAME/jackett/api/v2.0/server/config

In the test this returned 302. A Torznab request without the API key, or with a wrong one, returned Invalid API Key.

Jackett's login page at /user-USERNAME/jackett/ in the 24 October 2026 test, after the admin password was set.

Uninstall

docker rm -f jackett
rm ~/.lighttpd/custom.d/jackett.conf
touch ~/.lighttpd/custom

Deleting a fragment changes no remaining file, so touch ~/.lighttpd/custom makes your web server restart without it (deleting or disabling a fragment explains why). docker rmi lscr.io/linuxserver/jackett@sha256:d1b82a9c5bbaea44284a550af739bd838749b72f15b10ef61b6c9d9d1b2f1ed7 frees the image's disk space. The test removed the container and the image; removing the fragment and the folder was not tested.

Deleting the data is your choice. rm -rf ~/docker/jackett deletes the password file, the script, Jackett's config with every indexer login you added and the API key, and anything in ~/docker/jackett/downloads. In the test the files Jackett wrote belonged to the account, so a plain rm should be enough.

Troubleshooting

Step 3 prints a code other than 204, or the grep still shows null: Jackett may not have finished starting, or the container is not running after docker start. Check docker ps, wait a minute, and run step 3 again from its first line, because the request file was deleted. Do not publish the port while the password is null.
A red banner says "Jackett is running with root privileges": harmless here. In rootless Docker, root inside the container is your own account.
The address still answers 404 several minutes after you added the fragment: your web server has not picked it up yet; in a test on another Pulsed Media server the first fragment of an account took about 15 minutes. Run touch ~/.lighttpd/custom.
502 Bad Gateway: the container is not running or the port in the fragment is wrong; see the 502 section of Lighttpd Custom Configuration.
docker pull or docker run fails before Jackett starts: see the troubleshooting section of the Rootless DOCKER page.