Media stack pod: Radarr, Sonarr, Lidarr, Prowlarr, NZBGet, Bazarr

The quadlet files

Every quadlet file below passes podman's quadlet generator and systemd-analyze verify on podman 5.0 and the current release. Personal values are placeholders: replace example.com, /srv/... paths and the time zone with your own.

[Unit]
Description=Media automation pod

[Pod]
PodName=media
# Containers in a pod share one network namespace, so ports are published here.
# NZBGet
PublishPort=6789:6789
# Radarr
PublishPort=7878:7878
# Sonarr
PublishPort=8989:8989
# Prowlarr
PublishPort=9696:9696
# Bazarr
PublishPort=6767:6767
# Lidarr
PublishPort=8686:8686

[Unit]
Description=NZBGet Usenet downloader

[Container]
Image=lscr.io/linuxserver/nzbget:latest
ContainerName=nzbget
Pod=media.pod
AutoUpdate=registry
Environment=TZ=Etc/UTC
Environment=NZBGET_USER=nzbget
# Web UI password from a podman secret instead of the image's default.
Secret=nzbget-pass,type=env,target=NZBGET_PASS
Volume=nzbget-config.volume:/config
Volume=/srv/media:/data
# Restart the app when it hangs, not only when it crashes.
HealthCmd=nc -z 127.0.0.1 6789
HealthInterval=1m
HealthTimeout=10s
HealthRetries=3
HealthStartPeriod=2m
HealthOnFailure=kill

[Service]
Restart=always
# The first start pulls the image, which can take longer than the default 90 seconds.
TimeoutStartSec=900

[Install]
WantedBy=default.target

[Volume]
VolumeName=nzbget-config

[Unit]
Description=Radarr movie manager

[Container]
Image=lscr.io/linuxserver/radarr:latest
ContainerName=radarr
Pod=media.pod
AutoUpdate=registry
Environment=TZ=Etc/UTC
Volume=radarr-config.volume:/config
Volume=/srv/media:/data
# Restart the app when it hangs, not only when it crashes.
HealthCmd=curl -fsS -o /dev/null http://127.0.0.1:7878/ping
HealthInterval=1m
HealthTimeout=10s
HealthRetries=3
HealthStartPeriod=3m
HealthOnFailure=kill

[Service]
Restart=always
# The first start pulls the image, which can take longer than the default 90 seconds.
TimeoutStartSec=900

[Install]
WantedBy=default.target

[Volume]
VolumeName=radarr-config

[Unit]
Description=Sonarr TV series manager

[Container]
Image=lscr.io/linuxserver/sonarr:latest
ContainerName=sonarr
Pod=media.pod
AutoUpdate=registry
Environment=TZ=Etc/UTC
Volume=sonarr-config.volume:/config
Volume=/srv/media:/data
# Restart the app when it hangs, not only when it crashes.
HealthCmd=curl -fsS -o /dev/null http://127.0.0.1:8989/ping
HealthInterval=1m
HealthTimeout=10s
HealthRetries=3
HealthStartPeriod=3m
HealthOnFailure=kill

[Service]
Restart=always
# The first start pulls the image, which can take longer than the default 90 seconds.
TimeoutStartSec=900

[Install]
WantedBy=default.target

[Volume]
VolumeName=sonarr-config

[Unit]
Description=Lidarr music manager

[Container]
Image=lscr.io/linuxserver/lidarr:latest
ContainerName=lidarr
Pod=media.pod
AutoUpdate=registry
Environment=TZ=Etc/UTC
Volume=lidarr-config.volume:/config
Volume=/srv/media:/data
# Restart the app when it hangs, not only when it crashes.
HealthCmd=curl -fsS -o /dev/null http://127.0.0.1:8686/ping
HealthInterval=1m
HealthTimeout=10s
HealthRetries=3
HealthStartPeriod=3m
HealthOnFailure=kill

[Service]
Restart=always
# The first start pulls the image, which can take longer than the default 90 seconds.
TimeoutStartSec=900

[Install]
WantedBy=default.target

[Volume]
VolumeName=lidarr-config

[Unit]
Description=Prowlarr indexer manager

[Container]
Image=lscr.io/linuxserver/prowlarr:latest
ContainerName=prowlarr
Pod=media.pod
AutoUpdate=registry
Environment=TZ=Etc/UTC
Volume=prowlarr-config.volume:/config
# Restart the app when it hangs, not only when it crashes.
HealthCmd=curl -fsS -o /dev/null http://127.0.0.1:9696/ping
HealthInterval=1m
HealthTimeout=10s
HealthRetries=3
HealthStartPeriod=2m
HealthOnFailure=kill

[Service]
Restart=always
# The first start pulls the image, which can take longer than the default 90 seconds.
TimeoutStartSec=900

[Install]
WantedBy=default.target

[Volume]
VolumeName=prowlarr-config

[Unit]
Description=Bazarr subtitle manager

[Container]
Image=lscr.io/linuxserver/bazarr:latest
ContainerName=bazarr
Pod=media.pod
AutoUpdate=registry
Environment=TZ=Etc/UTC
Volume=bazarr-config.volume:/config
Volume=/srv/media:/data
# Restart the app when it hangs, not only when it crashes.
HealthCmd=curl -fsS -o /dev/null http://127.0.0.1:6767/api/system/ping
HealthInterval=1m
HealthTimeout=10s
HealthRetries=3
HealthStartPeriod=3m
HealthOnFailure=kill

[Service]
Restart=always
# The first start pulls the image, which can take longer than the default 90 seconds.
TimeoutStartSec=900

[Install]
WantedBy=default.target

[Volume]
VolumeName=bazarr-config

Why is it built this way?

Why a pod. The six apps call each other constantly: Prowlarr pushes indexers to Radarr, Sonarr and Lidarr, and those send downloads to NZBGet. In one .pod they share a network namespace and talk over localhost, the pod publishes every web UI in one place, and media-pod.service starts and stops the whole stack. The generated pod service pulls in every container that has Pod=media.pod, so you never start the containers one by one.

Why no .network file. A pod already has its own network namespace, and the containers in it never need to be found by name. A .network file is only worth adding when containers outside the pod must reach it by name, for example a reverse proxy container on the same network.

One config volume per app. Each app keeps its database and settings in its own named volume (radarr-config.volume and so on). Named volumes survive updates and recreation, podman creates them with the right ownership, and you can back up or reset one app without touching the others.

One shared media folder. Every app that touches files mounts the same host folder: Volume=/srv/media:/data, with downloads, movies and tv inside it. Because it is one mount, a finished download can be hardlinked into the library instantly. Quadlet also adds RequiresMountsFor=/srv/media to each generated service, which matters when the folder is a NAS mount.

latest with auto-update and rollback. The linuxserver images publish only latest and exact build tags, no major-version tags. latest is their stable channel, so these files use it with AutoUpdate=registry: podman auto-update restarts changed containers and rolls back an image that fails to start. Pin an exact version-… tag instead if you prefer to update by hand.

Health checks. A crashed app is restarted by Restart=always, but a hung one keeps running. Each container calls its app's own ping URL once a minute on 127.0.0.1; after three failures in a row, HealthOnFailure=kill stops it and systemd starts it again. HealthStartPeriod= gives slow first starts and database migrations time before failures count.

Rootless. All ports are above 1024 and nothing needs host access, so the stack runs under a normal user. TimeoutStartSec=900 gives the first start time to pull the images; the systemd default of 90 seconds is often too short.

How do I start it?

Run these as your normal user, not as root. Quadlet reads ~/.config/containers/systemd/ for user services.

mkdir -p ~/.config/containers/systemd
# one media folder, owned by the containers' user (UID 911 in linuxserver images)
sudo mkdir -p /srv/media && sudo chown "$USER": /srv/media
mkdir -p /srv/media/downloads /srv/media/movies /srv/media/tv /srv/media/music
podman unshare chown -R 911:911 /srv/media
# NZBGet web UI password
openssl rand -hex 16 | tr -d '\n' | podman secret create nzbget-pass -
systemctl --user daemon-reload
systemctl --user start media-pod.service
systemctl --user enable --now podman-auto-update.timer
loginctl enable-linger "$USER"

Check the result with systemctl --user status and the logs with journalctl --user -u followed by the service name. To turn a docker-compose file of your own into files like these, use the compose to quadlet converter.

Common mistakes

Frequently asked questions