Self-Hosted Apps on PMSS

Every Pulsed Media seedbox includes rootless Docker, so an application that PMSS does not install itself can still run inside your account. This page lists 39 such applications by category, with the facts that decide whether and how each one fits: its container image, how it runs under a URL path, whether it has a login of its own, and what it needs without Docker. The facts come from each project's own documentation, read on 7 October 2026 and rechecked on 15 and 16 October 2026; Pulsed Media has not tested these applications, only the proxy method most of them use.

Running an application that PMSS does not install

The same four steps apply to every application below that runs under a path; the own-hostname ones are listed after the steps, and Deleterr has no web interface. The full instructions are on Rootless DOCKER and Lighttpd Custom Configuration.

Run the container bound to loopback. Publish its port on 127.0.0.1 only, for example -p 127.0.0.1:9090:80, using an unused port above 1024 (check with ss -tlnp). This keeps the application off the internet. It does not keep it private on the server: other accounts on the same server can connect to 127.0.0.1 too, so the application's own login is what protects it.
Add a proxy fragment in ~/.lighttpd/custom.d/ for /user-USERNAME/APPNAME/. The application is then at https://SERVER.pulsedmedia.com/user-USERNAME/APPNAME/ over HTTPS.
Pick the fragment variant from the table. An application with a base-path setting gets that setting set to /user-USERNAME/APPNAME and a fragment without map-urlpath; a few take the full address instead, or need a trailing slash, as their row says. An application documented as working behind path stripping keeps map-urlpath. Where the column says Not documented, start with map-urlpath; if the page loads without styling or its links jump to the server root, the application needs a base-path setting or its own hostname. Always keep "upgrade" => "enable": many applications use WebSockets for live pages and players, and they hang without it.
Secure the application before you open it up. Other accounts on the server can reach it on 127.0.0.1 from its first start, so secure it straight away. Where it takes its admin user and password as settings, set them before the first start. Otherwise start with the fragment that keeps your panel login in front, without auth.require = (), then create your account, change any default password and close open signups. After that, add auth.require = () so the application's own login page is reached; an application that uses HTTP basic auth needs this, or its login loops. Put setenv.set-request-header = ( "Authorization" => "" ) inside every fragment, with or without auth.require = (); without it, a browser that is logged into your panel sends your panel password to the application with every request. The one exception is an application that uses HTTP basic auth itself: the line would remove its own login as well. Never use an option that switches login off for local or private addresses: requests through the proxy and connections from other accounts both arrive from such an address, so the option switches the login off for everyone. If the Login column says None or Not stated, check whether the application has a login at all; without one, any account on the same server can open it. On a shared server, run an application with no login only if nothing in it would matter if another customer read or changed it.

Every account has a memory limit set by its plan. The torrent clients and every container share it, along with the account's CPU. Where a project documents a memory minimum, the table shows it; Immich, Storyteller and PhotoPrism need several gigabytes, which the plan's limit has to cover. Applications that need several containers are easiest to run with Docker Compose where your server has it (docker compose version); publish only the web port, as 127.0.0.1:PORT:PORT, and leave database and cache containers unpublished, because every account on the server can reach a port published on 127.0.0.1.

Applications that their documentation says must run at the root of their own hostname do not fit the /user-USERNAME/APPNAME/ pattern. They are listed so you can see that before you start. Pulsed Media has not documented a tested setup for them.

Applications that existing pages already cover are not listed here: the torrent clients, the stack that Install Media Stack installs (Jellyfin, Sonarr, Radarr, Prowlarr, SABnzbd, Autobrr, Cloudplow), and the containers listed on Pulsed Media Seedbox and Storage Features, such as Lidarr. OpenClaw, the self-hosted AI agent, has its own PMSS installer instead of a container: see OpenClaw on PMSS. Where your panel's ⚙ Configure tab (or the Apps tab, on a panel without Configure) lists qui, slskd, Copyparty or Scryer, PMSS runs that application for you; its row below says how.

The Path column says how to serve the application under /user-USERNAME/APPNAME/. Login is the application's own default. Without Docker is what the project ships for running directly on Linux; on Pulsed Media servers that runs as your user, so anything that needs a system package or root is not an option. A program run this way listens wherever its own settings say, and some listen on every address by default, which puts them on the internet: set its listen address to 127.0.0.1 and an unused port above 1024, then follow steps 2 to 4. Python 3 and PHP are installed on every server, at versions that depend on its Debian release (for example PHP 8.2 on Debian 12); Java, .NET and Node.js are not part of the server's package set, so those runtimes have to be unpacked into your home directory. "Not documented" and "Not stated" mean the project's documentation does not say, so such an application may or may not work under a path.

Media servers and live TV

Application	What it does	Path	Login	Without Docker	Notes
Tunarr `chrisbenincasa/tunarr`	Builds live-TV channels from a Jellyfin, Plex or Emby library or local media	Not documented	Optional basic auth, off by default	Linux binary	Set `TUNARR_BASIC_AUTH_USER` and `TUNARR_BASIC_AUTH_PASSWORD` before you start it, or any account on the same server can open it
Channels DVR `fancybits/channels-dvr`	Records live TV from tuners, IPTV or TV Everywhere for the Channels apps	Not documented	None for local connections	Vendor installer	Closed-source commercial product; 512 MB RAM minimum, 1 GB recommended; needs a TV source; its developer, in 2023: "LAN is assumed to be a trusted environment. There is no authentication in place." Any account on the same server can open its admin page on 127.0.0.1
Threadfin `fyb3roptik/threadfin`	Presents M3U/XMLTV playlists as a TV tuner to Jellyfin, Plex or Emby	Not documented	Optional, off by default	Linux binary	No release since 11 September 2025; starts with no login: turn on authentication in its settings right after the first start, or its playlists stay open
Koel `phanan/koel`	Streams your own music collection in the browser, with playlists	Not documented	Yes	Linux binary (bundles its own PHP)	The Docker image needs a separate MariaDB, MySQL or PostgreSQL container and creates a default admin (`admin@koel.dev` / `KoelIsCool`): change it right after the first start; the Linux binary uses SQLite, keeps its data in `~/.koel`, and is started with `./koel php-server --listen 127.0.0.1:PORT`
mStream `lscr.io/linuxserver/mstream` (community image)	Music streaming server with a web player and mobile apps	Not documented	Optional, off by default	Linux binary	Open to anyone who reaches it until you create a user; run without Docker, it listens on every address on port 3000 by default: set `address` to 127.0.0.1 in its config

Comics, books and audiobooks

Application	What it does	Path	Login	Without Docker	Notes
Komga `gotson/komga`	Comics, manga and ebook server with a web reader and OPDS feeds	Set `SERVER_SERVLET_CONTEXTPATH`	Yes	Java jar (JRE 17+)	The first visitor creates the admin account: create it right after the first start; Java limits it to about 1 GB of memory by default: if the logs show OutOfMemory errors, raise it with `JAVA_TOOL_OPTIONS=-Xmx…`, within your plan's memory
Ubooquity `lscr.io/linuxserver/ubooquity` (community image)	Comic and ebook server with a browser reader and OPDS feed	Not documented	Optional, off by default	Java jar	Freeware, non-commercial use only; no release since 10 August 2025; the first visitor to its admin page (port 2203) chooses the admin password, so set it right after the first start; the library (port 2202) is open until you add users
Calibre `lscr.io/linuxserver/calibre`	The full Calibre ebook manager, shown as a desktop in the browser	Set `SUBFOLDER` with leading and trailing slash	Optional basic auth, off by default	Linux binary (isolated install, no root, Debian 12+; the command-line tools and calibre-server run without a desktop)	Upstream recommends `--shm-size=1gb`; its desktop has a terminal with passwordless sudo, so set `CUSTOM_USER` and `PASSWORD` before you start it; proxy to its port 8080; in the setup wizard keep the library at `/config/Calibre Library`
Calibre-Web Automated `crocodilestick/calibre-web-automated`	Web library for a Calibre collection that imports and converts books dropped in a folder	Not documented	Yes	Not offered	Default login admin/admin123: change it right after the first start; files in the import folder (`/cwa-book-ingest`) are deleted after processing, with the originals kept in `/config/processed_books` by default; web port 8083
BookLore `ghcr.io/booklore-app/booklore`	Ebook and comic library with shelves, a web reader and device sync	Own hostname only	Yes	Not offered	Needs a MariaDB container; the first visitor creates the admin account: create it right after the first start; in maintenance mode upstream (its successor is BookOrbit)
Grimmory `grimmory/grimmory`	Community fork of BookLore for ebooks, comics and audiobooks	Own hostname only	Yes	Not offered	Needs a MariaDB container; the first visitor creates the admin account: create it right after the first start
Storyteller `registry.gitlab.com/storyteller-platform/storyteller`	Aligns an audiobook with its ebook so the text follows the narration	Not documented	Yes	Not offered	Needs `STORYTELLER_SECRET_KEY` set before the first start; create the admin account right after the first start; 8 GB RAM and up to 4 cores per upstream

Downloads and requests

Application	What it does	Path	Login	Without Docker	Notes
qui `ghcr.io/autobrr/qui`	One web interface for several qBittorrent instances, with automation rules	Set `QUI__BASE_URL`	Yes	Linux binary	The first visitor creates the account: create it with `qui create-user` before the first start, or right after it; never turn on its login-off mode (`QUI__AUTH_DISABLED`): requests through the proxy and from other accounts on the server all arrive from 127.0.0.1; if your panel's Configure or Apps tab lists qui, use Turn on there instead: PMSS runs it at `/user-USERNAME/qui/`, creates your login and shows the user name and password on that row, and restarts it if it crashes, until five restarts in a row fail
JDownloader 2 `jlesage/jdownloader-2` (community image)	Download manager for direct links and file-hosting sites	Path stripping (keep `map-urlpath`)	Optional, off by default (in the image)	Java jar (without a desktop, you control it through the MyJDownloader online service)	Before you start it, set `WEB_AUTHENTICATION=1` with `WEB_AUTHENTICATION_USERNAME` and `WEB_AUTHENTICATION_PASSWORD`, and `WEB_AUTHENTICATION_ALLOW_INSECURE=1` because the proxy reaches the container over plain HTTP; set `JDOWNLOADER_MAX_MEM` below your plan's memory, or the image sizes Java's memory from the whole server's RAM
slskd `slskd/slskd`	Web client for the Soulseek network	Set `SLSKD_URL_BASE`	Yes	.NET binary	Default login slskd/slskd; set `SLSKD_USERNAME` and `SLSKD_PASSWORD` before you start it; Soulseek peers connect on a separate port (50300 by default), which must be reachable from the internet, unlike the web interface; run without Docker, its web interface listens on every address by default: set `SLSKD_HTTP_IP_ADDRESS=127.0.0.1` and switch its HTTPS listener off with `SLSKD_NO_HTTPS=true` before the first start; if your panel's Configure or Apps tab lists slskd, use Turn on there instead: PMSS runs it at `/user-USERNAME/slskd/`, creates your login and shows the user name and password on that row, and restarts it if it crashes, until five restarts in a row fail
Seerr `ghcr.io/seerr-team/seerr`	Media request manager for Jellyfin, Plex and Emby; successor of Overseerr and Jellyseerr	Own hostname only	Yes, via the media server's accounts	Node.js 22 build	Setup needs a reachable Jellyfin, Plex or Emby server: you sign in through its accounts; the image runs as UID 1000, which under rootless Docker is a different ID from your account, so the upstream `chown 1000:1000` step fails on the server: run it inside Docker instead, `docker run --rm -v PATH:/c busybox chown -R 1000:1000 /c`
DroppedNeedle `droppedneedle/droppedneedle`	Music requests that drive your own slskd or SABnzbd; formerly Musicseerr	Not documented	Yes	Not offered	The first account created is the admin: create it right after the first start; no base-path setting yet (upstream issue #176 is open), so it needs its own hostname; with slskd it needs slskd 0.25.0 or newer and at least one shared folder
ReadMeABook `ghcr.io/kikootwo/readmeabook`	Audiobook requests: searches, downloads, merges chapters and imports	Not documented	Yes	Not offered	One image with PostgreSQL and Redis inside; needs Audiobookshelf (or Plex, which can only be used with dedicated servers), Prowlarr, and qBittorrent or SABnzbd; the setup wizard creates the admin account, so run it right after the first start

Library automation

Application	What it does	Path	Login	Without Docker	Notes
Scryer `ghcr.io/scryer-media/scryer`	One program for movie, TV and anime automation	Set `SCRYER_BASE_PATH`	Form login; turn it on with `SCRYER_AUTH_ENABLED=true` and set `SCRYER_ADMIN_PASSWORD`	Linux binary	Set them before you start it; pre-1.0; heavy CPU and disk for the first hours after install; never turn on its Skip login for local IPs setting: requests through the proxy and from other accounts on the server all arrive from local addresses; if your panel's Configure or Apps tab lists Scryer, use Turn on there instead: PMSS runs it at `/user-USERNAME/scryer/`, creates your login and shows the user name and initial password on that row, and restarts it if it crashes, until five restarts in a row fail
Medusa `pymedusa/medusa`	TV library manager in the Sick-Beard family	Set `web_root`	Optional, off by default	Python 3.9+	Starts with no login: set `web_username` and `web_password` right after the first start; run without Docker, it listens on every address by default, so set `web_host` to 127.0.0.1 in its config before you open it
SickGear `lscr.io/linuxserver/sickgear` (community image)	TV and anime library manager in the Sick-Beard family	Set `web_root`	Optional, off by default	Python 3.10+	Starts with no login: set `web_username` and `web_password` right after the first start
Headphones `lscr.io/linuxserver/headphones` (deprecated image)	Music library downloader, predecessor of Lidarr	Set `http_root`	Optional, off by default	Python 3	No commit on its main branch since June 2025; the image gets no updates; starts with no login: set `http_username` and `http_password` right after the first start
Mylar3 `lscr.io/linuxserver/mylar3`	Follows comic series and fetches new issues	Set `http_root`	Optional, off by default	Python 3	No release since 17 August 2025; starts with no login, and a username and password alone do not turn it on: also set authentication to the login form right after the first start
Bindery `ghcr.io/vavallee/bindery`	Follows authors and fetches new ebooks and audiobooks	Set `BINDERY_URL_BASE`	Yes	Linux binary	The first visitor creates the admin account: create it right after the first start; sends a daily anonymous telemetry ping unless disabled; keep its auth mode on Enabled: Local only lets every request through the proxy in without a login
Profilarr `ghcr.io/dictionarry-hub/profilarr`	Builds and syncs quality profiles to Sonarr and Radarr	Not documented	Yes	Not offered	The first visitor creates the only account: create it right after the first start; behind a reverse proxy set `ORIGIN` to the address you open it at, or logins fail with a 403

Library maintenance and transcoding

Application	What it does	Path	Login	Without Docker	Notes
Maintainerr `ghcr.io/maintainerr/maintainerr`	Rule-based cleanup of old titles in Plex, Jellyfin or Emby	Set `BASE_PATH`	None	Not offered	Deletes media by design; no login, so any account on the same server can open it and read the media-server and *arr credentials it stores; sends an anonymous weekly usage report unless `TELEMETRY=off`
Cleanuparr `ghcr.io/cleanuparr/cleanuparr`	Clears stalled and failed downloads from download queues	Set `BASE_PATH`	Yes	Linux binary (self-contained, no .NET runtime needed)	Deletes downloads by design; the first visitor creates the account: create it right after the first start, and leave Disable Auth for Local Addresses off
Deleterr `ghcr.io/rfsbraz/deleterr`	Scheduled deletion of watched or stale media by rules	No web interface	—	Python 3.12+	Deletes media by design; needs a Plex server (Plex can only be used with dedicated servers) and Radarr or Sonarr; Tautulli is optional
Tdarr `ghcr.io/haveagitgat/tdarr`	Transcodes or remuxes a library in batches with FFmpeg or HandBrake	Path stripping (keep `map-urlpath`)	Yes, on by default	Linux binary	Before the first start, set `seededApiKey` and `apiKey` to the same `tapi_` key: that creates the admin user with the key as its password, so nobody else can claim it, and lets the built-in node connect; proprietary licence; transcoding runs on the CPU and is heavy
Unmanic `josh5/unmanic`	Watches a library and runs plugin-driven FFmpeg jobs	Not documented	None	Python 3.8+	Plugins can run any command, and it has no login, so any account on the same server can run commands as you through it
tinyMediaManager `tinymediamanager/tinymediamanager`	Scrapes metadata and artwork, writes NFO files, renames; the image shows the desktop app in the browser through noVNC	Not documented	Optional, off by default	Linux build with its own Java	Set `PASSWORD` before you start it; the free version scrapes from TMDB only, other scrapers and subtitle download need the paid PRO tier

Photos, files and passwords

Application	What it does	Path	Login	Without Docker	Notes
Immich `ghcr.io/immich-app/immich-server`	Photo and video library with phone backup	Own hostname only	Yes	Not offered	Four containers; 6 GB RAM minimum, 8 GB recommended, 2 cores minimum; with machine learning switched off it can run in 4 GB; the first user registered is the admin; the upstream compose file publishes port 2283 on every address, so publish it as `127.0.0.1:PORT:2283`
PhotoPrism `photoprism/photoprism`	Indexes, tags and searches photos and videos	Own hostname (sub-path is experimental upstream)	Yes	Linux binary	3 GB RAM and 2 cores minimum; MariaDB container in the example setup (without it, it uses SQLite); upstream advises against a hard memory limit, and every account has one; the example compose file sets the admin password to `insecure` and publishes port 2342 on every address: change `PHOTOPRISM_ADMIN_PASSWORD` before the first start and publish it as `127.0.0.1:PORT:2342`
Copyparty `copyparty/ac`	File server with resumable uploads, search, thumbnails and share links	`--rp-loc`, no `map-urlpath`	Optional, off by default	Python 3 (one file)	Without accounts, anyone can read and write the shared folder; create an account (`-a USER:PASS` or an `[accounts]` section) before you start it; upstream says `--rp-loc` only works with its real-IP settings (`--xff-hdr`, `--xff-src`) set for the proxy; if your panel's Configure or Apps tab lists Copyparty, use Turn on there instead: PMSS runs it at `/user-USERNAME/copyparty/`, creates your login and shows the user name and password on that row, and restarts it if it crashes, until five restarts in a row fail
Vaultwarden `vaultwarden/server`	Password-manager server for the Bitwarden apps and extensions	Full address, including the path, in `DOMAIN`; no `map-urlpath`; open it with a trailing slash	Yes	Not offered as a release	Signups are open by default; close them with `SIGNUPS_ALLOWED=false` after creating your account

Dashboards, chat and desktop

Application	What it does	Path	Login	Without Docker	Notes
Organizr `organizr/organizr`	Puts other apps behind one login as tabs	Not documented for the Docker image; a sub-directory install is documented for the non-Docker install	Yes	PHP with the SQLite extension (Debian 12 servers)	The first visit opens its setup, where you create the admin account: do that straight away; the Docker image has not been rebuilt since December 2023
The Lounge `lscr.io/linuxserver/thelounge`	Always-on IRC client in the browser	Path stripping (keep `map-urlpath`)	Yes	Node.js 22+	Set `reverseProxy: true` in its config; there is no sign-up page: add your user with `thelounge add USER` (in the LinuxServer.io image, `docker exec -it CONTAINER s6-setuidgid abc thelounge add USER`)
Mattermost `mattermost/mattermost-team-edition`	Team chat with channels, direct messages and file sharing	Full address, including the path, in `SiteURL`; no `map-urlpath`	Yes	Linux binary	Needs PostgreSQL 15+ for Mattermost 12 (14+ for the 11.7 ESR); 2 GB RAM for up to 1,000 users; the upstream Docker files publish the app port on every address and default to the enterprise image, so publish `127.0.0.1:PORT:8065` and set the team-edition image
Webtop `lscr.io/linuxserver/webtop`	A full Linux desktop in a browser tab	Set `SUBFOLDER` with leading and trailing slash	Optional basic auth, off by default	Not offered	A desktop with a terminal: set `CUSTOM_USER` and `PASSWORD` before you start it; upstream calls this login suitable only for a trusted local network; upstream recommends `--shm-size=1gb`, and its example publishes ports 3000 and 3001 on every address, so publish only `127.0.0.1:PORT:3000`

At Pulsed Media

Rootless Docker is part of every Pulsed Media seedbox plan, so each application above runs inside your account as your user, and the ones that run under a path are reached over HTTPS through your own web server. On 7 October 2026 Pulsed Media tested that path on a live server with a throwaway account and a test container: the documented proxy fragment carried plain requests and WebSocket upgrades, the container received the full path when map-urlpath was removed, and leaving out auth.require = () kept the panel login in front of its web address. PMSS itself installs the media stack (Jellyfin, Sonarr, Radarr, Prowlarr, SABnzbd and more) with one command, and its torrent clients from the panel.

Every application here runs on the same storage that holds your torrents, so a library manager, a transcoder or a photo server works on the files where they already are. Seedbox plans differ in RAM, so check a heavy application's memory minimum in the table against the plan you are on or considering; Seedbox and Storage Box Resource Tiers lists the numbers.

Troubleshooting

502 Bad Gateway, a login loop or a page that loads but never goes live: see the troubleshooting section of Lighttpd Custom Configuration.
The container keeps stopping: read docker logs NAME, and compare the application's documented memory minimum in the table with your plan's memory. An application that needs more than the plan leaves free does not run reliably.
docker run says the port is already allocated: another process uses it; pick a different port.