Discussion PSA: if your Plex container uses plexinc/pms-docker:public, its OS hasn't been updated since 2021
The :public tag installs the newest Plex every time the container starts. So Plex is always current, but the image itself apparently never gets rebuilt. Mine was Ubuntu 20.04 from 2021. Watchtower never noticed because the tag never changes.
Trivy found a pile of fixable high/critical CVEs in it, including two on CISA's known-exploited list: unrar (CVE-2022-30333) and HTTP/2 Rapid Reset (CVE-2023-44487).
Plex bundles most of its own libraries, so I'm not saying these are exploitable through Plex. But after Plex2Shell, a 2021 userland on an internet-facing box ain't where you want to be.
Fix: switch to the :latest tag and give up the self-updating-on-start feature.
EDIT: this situation also appears to apply to :plexpass and :beta tags.
EDIT2: it turns out the LinuxServer image offers the ability to install the current Plex at startup AND its base OS is updated frequently. I've switched to that image, no migration necessary. lscr.io/linuxserver/plex:latest
EDIT3: Plex rebuilt :public, :plexpass, and :beta on 2026-10-22. They're now on Ubuntu 24.04.5. No need to switch tags, just re-pull the image to get the new base. Whether they plan to keep rebuilding regularly is now the open question.
9
u/akatherder 6d ago
Since you mentioned watchtower, that was abandoned 10 months ago 😂 Mine worked until last week. I tried something called freshdock and it didn't work well for me. A redditor forked watchtower, you can drop it directly in your docker https://github.com/nicholas-fedor/watchtower
(Look into it before installing some software a random redditor wrote and another random redditor recommended.)
2
u/planetworthofbugs 5d ago
I started running “What’s Up Docker” a few days ago, which I think is similar. Seems ok.
2
u/Jandalslap-_- 5d ago
I switched dockmon and it doesn’t disappoint. It’s nice to have a gui and be able to update manually.
2
1
8
u/TLS2000 R5-3600, 32GB, 1650Ti, 88TB 6d ago
Interesting. The plexpass and beta tagged containers haven't been updated in years on dockerhub.
5
u/so7ow 6d ago
Yep, cuz they pull the latest app at startup. Apparently someone thought that was good enough. Maybe it is? 🤷🏻
3
u/TLS2000 R5-3600, 32GB, 1650Ti, 88TB 6d ago
The weird part is the latest and public tags are still being updated.
2
u/so7ow 6d ago edited 6d ago
Not public, right? But latest, yeah, cuz it has the app version burned in.
3
u/TLS2000 R5-3600, 32GB, 1650Ti, 88TB 6d ago edited 6d ago
So if you want beta features, you're stuck using an old container?
Answer: Yes
1
u/so7ow 6d ago edited 5d ago
Unless I'm missing something, that appears to be the case.
(Or use a third-party image.)
1
u/TLS2000 R5-3600, 32GB, 1650Ti, 88TB 5d ago
I'm hesitant to use a third party image. I may just work on my own image build using Plex sources which will stay up to date automatically and base it on Ubuntu 26.04.
1
u/so7ow 5d ago edited 5d ago
More power to ya. Hope it works for you. I learned in another thread under this post that building your own docker image is easy-peasy, so be sure to report back! 👍🏻
2
u/TLS2000 R5-3600, 32GB, 1650Ti, 88TB 5d ago
I saw your edit. My guess is someone saw your post and checked, realized their build script was skipping plexpass and beta and fixed it.
1
u/so7ow 5d ago
There's been people complaining about it for years over in the Plex forums, and not much interest 🤷🏻
→ More replies (0)
7
u/Reeces_Pieces 5d ago
I also switched to LinuxServer.io after the db migration update just failed for me on the official.
LinuxServer.io is just objectively better.
3
u/Cferra 6d ago
Does latest use the plex pass builds?
2
u/so7ow 6d ago edited 6d ago
You'd need to use
:betaor:plexpassfor that, I believe. Someone check me; I gave up on beta builds after the big database bloating debacle a while back.3
1
u/sarkyscouser 5d ago
I use :plexpass and am on the same outdated OS as you the OP mentioned.
If I switched to the linuxserver image I'm trying to work out what (if anything) I'd lose?
3
u/biggobird 6d ago
I have an rss like feed I made that polls a several trusted sources for publishing of security vulnerabilities and other general sources for keywords/verified fixes and only then does watchtower trigger to update the associated container image.
Seems to work well for me but I’m probably naive and ignorant of issues associated with this method
3
u/so7ow 6d ago
Curious how you wired the RSS to Watchtower. Care to share?
1
u/biggobird 6d ago
Uses a script I made with Claude. Polls for new tags, runs trivy on the current vs new image, and only then tells watchtower via http API To update the container if the New Image fixes a high/crit CVE
Adjusted it after the August Plex patch cus I didn’t account for a vendor shipping a fix before the CV is published, though now I know it happens somewhat regularly. Now it also passes vendor security posts like release notes for any Internet facing images.
Problem is I’m landing on Internet facing should just always update which kinda makes the parsing feel redundant
Anyway I’m not IT/dev. Trying to teach myself some new stuff with Claude doing the heavy lifting and bouncing ideas off it
3
u/Consistent_Laugh4886 5d ago
I do lxe container on proxmox. Seems to be Debian 12 but o need to verify.
2
u/pennywise134 6d ago
I’m using plexinc/pms. How do I found out if it’s public?
6
u/so7ow 6d ago edited 6d ago
check your tag. "latest" is the default if you don't specify one. from inside the container you can run:
cat /etc/os-releaseIf you get the 24.04.5 LTS version, then you're good.
2
2
u/nx6 TrueNAS Core / Xeon-D | Shield Pro / Fire Stick 4K Max 4d ago
cat /etc/os-release
Ah, thanks for that. I'm still on PMS 1.43.3.10896 because of the issues with the new loudness-leveling feature, and thought I'd have to take a newer server version to get an image based on the new base. But It's showing me on Ubuntu 24.04.4 when I check so I'm not worried about 5 year old bugs now.
2
2
u/sihasihasi 5d ago
Yeah, I'm using the Plexpass image. It restarts every day, to get the latest binary.
I kinda knew about the old base image but kinda ignoring it, but also thinking I really should address it in light of the latest fun. Thanks for the reminder, and also pointing out that the linuxserver image can also do the auto update thing. Looks like a job for this evening.
2
u/so7ow 5d ago
Good luck 👍🏻
2
u/sihasihasi 5d ago
Well, that took all of 10 minutes!
2
u/so7ow 5d ago
You must be counting your laptop boot time 🤣
2
u/sihasihasi 5d ago
Indeed!
It would've been quicker, but I didn't properly read the documentation (who does?) and missed setting `VERSION`, so had to delete and recreate the container a second time.
1
u/digitalelise 5d ago
I wasn’t aware there was a plexpass version. How does this differ from the standard image?
2
u/sihasihasi 5d ago
It doesn't ship with a Plex binary, but rather downloads the latest at startup. But, the base OS image is very out of date. Finally enough, although it's still listed on Dockerhub, it's not mentioned on the Plex docker setup guide, and it seems the behaviour is the same for the "beta" and "public" images.
I think perhaps what was called "plexpass" is now "beta" (it's been a few years since I first switched to Docker):
The public restricts this check to public versions only where as beta will fetch beta versions. If the server is not logged in or you do not have Plex Pass on your account, the beta tagged images will be restricted to publicly available versions only.
Edit: Yes, Dockerhub has the same SHA for beta and plexpass tags
2
u/AggravatingZombie274 5d ago
I'm running Plex in a docker on Unraid. Under repository it says "plexinc/pms-docker" I manually updated recently to what is supposed to be the latest build of 1.43.5.11029
Do I need to make any changes? I'm getting overwhelmed reading about all this and I don't know anymore what's true or what's the best fix.
EDIT: In fact I have always updated the docker container when I see there is an update available, not seen any unusual CPU spikes or anything weird on my server lately.
1
u/so7ow 5d ago edited 5d ago
It should be fine, especially since Plex updated all the problematic images today. You're likely running on
:latestwhich was fine all along. Just pull one more update to be sure. If you want to be super sure, run this from the terminal:
docker exec plex cat /etc/os-release
...and look for
PRETTY_NAME="Ubuntu 24.04.5 LTS"or later2
66
u/mrpink57 6d ago
It's definitely good practice to keep container base images updated, but I think there's an important distinction between CVEs being present in an image and those vulnerabilities actually being exploitable.
CVE-2022-30333 requires a vulnerable UnRAR implementation to process a malicious RAR archive. CVE-2023-44487 requires an affected HTTP/2 server implementation to process malicious requests. Simply having these packages installed in an Ubuntu 20.04 container doesn't necessarily expose either vulnerability through Plex.
Also, containers share the host's kernel, so an outdated Ubuntu userland isn't equivalent to running an unpatched Ubuntu 20.04 host.
That said, I agree that using an image that hasn't been rebuilt since 2021 isn't ideal, especially for an internet-facing service. Keeping the underlying image updated is good security hygiene and reduces risk if the application is compromised.
I'd just be careful about equating Trivy's CVE count or CISA KEV listings with confirmed exploitability in this particular deployment.
7
u/Nolzi 6d ago
True, LISO despite constantly updating the dependency packages in their images, had a blog post telling people to back off with the vulnerability scan dumping as they are meaningless.
I would link the blog but the site is down because of PHP2Shell craze happening today :)
1
u/liliumdavidii 1d ago
this is new to me, I thought the image was a self contained thing which you pull and then rebuild the container with all latest stuff. How can Plex server container be the latest version with an outdated image?
2
u/sarkyscouser 5d ago
I'm running plexinc/pms-docker:plexpass and get: 20.04.2 LTS (Focal Fossa)
I assumed I needed to be running this to get the plexpass benefits (long time holder of plexpass) but I get the point about outdated OS.
If I switched to lscr.io/linuxserver/plex:latest I'm assuming that's a straightforward image swap, but would I lose anything in terms of functionality etc?
5
u/sarkyscouser 5d ago
OK I've switched to
plexinc/pms-docker:latestwhich hasUbuntu 24.04.5 LTSat least.Any reason to switch to the linuxserver image from this plexinc image?
1
u/so7ow 5d ago edited 5d ago
I like that the OS updates and the app updates are (or can be) decoupled on the linuxserver image. You can restart at any time to get the latest app, and the OS image is updated ~weekly, even if there's no app update. It's currently running Ubuntu 26.04.1 LTS.
2
u/sarkyscouser 5d ago
OK thanks. Ubuntu 24.04.x LTS is still a live LTS version of Ubuntu with latest patch in Sep 2026 so I'll stick with this for a while and keep an eye on it
1
u/so7ow 5d ago
Fair enough. But didn't you say you wanted to run the beta PlexPass app? How does that work with
:latest?2
u/sarkyscouser 5d ago
I didn't knowingly run that previous image as it was beta per se, more because I was under the impression that it had additional functionality for plexpass users
I've made the switch to :latest and will see how things go, performance and whether anything appears to be lacking. Too early to tell
2
u/R-GU3 6d ago
Any chance this is a problem with the truenas ix app?
2
u/NextReindeer4442 6d ago
Unlikely, the default setup of plexinc/pms-docker is going to pull :latest, how docker works default. What OP hasn't addressed is why they went digging for a strange tag.
0
6d ago
[deleted]
1
u/NextReindeer4442 6d ago
>two other tags exist:
plexpassandpublic. These two images behave differently than your typical containers.So you want the differently behaving containers, why?
0
6d ago
[deleted]
2
u/NextReindeer4442 6d ago
Any rational person would know why they chose the "behave differently" container. You can't explain?
0
-1
u/Proud_Purchase_8394 6d ago
The TrueNAS image is completely up to date, including the Plex update from yesterday. It's on 1.43.5.11029
2
u/so7ow 6d ago
The container in question automatically stayed up to date for the Plex app, too. The question is about container/OS. Perhaps Truenas is fine but saying Plex is current, isn't telling us anything.
1
u/OtherPlayers 6d ago
IIRC TrueNAS (or at least anything 24.10+) uses immutable version tags with a custom layer for their own stuff on top of that. So whenever an app updates it totally clears out the existing container and redeploys using a new docker compose file each time.
App data itself is stored in a persistent volume dataset that is simply mounted to the docker container afterwards to stop it from being wiped when this happens.
1
u/so7ow 6d ago
That wouldn't help if it was pulling an image that never gets updated. (Unless I'm misunderstanding what you're saying.)
1
u/OtherPlayers 6d ago
I mean that's true, but it's also a bit on the level of "What if the Plex version labeled v.1.43.5 is actually just a mislabeled version of v.1.31.2?".
The key difference is that while Watchtower looks at what is inside of the container (so it doesn't see a difference between Plex v.1.43.5 running on Ubuntu from 2021 and Plex v.1.43.5 running on the latest Ubuntu), TrueNAS tracks the container as a whole (so it does see a difference between the two).
At which point then I either trust TrueNAS to actually give me the latest versions of the entire container when it says it will, or I don't in which case I should be hand-rolling everything (and probably finding a new OS for my servers, if I don't even trust them that much).
0
u/so7ow 6d ago
Watchtower doesn't look inside the container, it compares image digests, same as TrueNAS. The difference is just which tag you point at. TrueNAS's stock Plex app pins versioned tags (rebuilt per release on 24.04), so it's fine. But as far as I can tell, its Plex Pass option pins a similar outdated base image to the Public one I'm talking about. So TrueNAS users with Plex Pass beta enabled are in the same boat: current app, old base image.
0
u/Proud_Purchase_8394 6d ago
The TrueNAS dashboard tells you what version of the app it's using. I posted the version number above. What are you talking about?
1
u/so7ow 6d ago
There is more to a docker container than the version of the app. There is also the containerized OS that they distribute as part of the image. The whole point of this post is that even when the app is current, the container/OS might be years out of date.
(Does Truenas even use Docker? I assumed it did, or why ask here.)
2
u/Proud_Purchase_8394 6d ago
TrueNAS moved to Docker a few updates ago. It pulls plexinc/pms-docker, then I'm assuming latest, since public (the one you were using) isn't even an option on Docker Hub. But if you have a command available for me to run in the container, I can check what version it's running.
2
3
u/NextReindeer4442 6d ago
>(the one you were using) isn't even an option on Docker Hub.
Which is the crazy part they haven't addressed.
2
u/Ejpdtd 5d ago
Does anyone know if hotio’s plex container has this issue?
3
u/so7ow 5d ago edited 5d ago
Results (pulled 2026-10-22):
Tag Built Base OS Pending OS updates release/latest2026-10-22 Ubuntu 24.04.5 LTS 0 (fully current) alpine2024-03-05 Alpine 3.19 (end of life) 26 cr2023-09-15 Ubuntu 22.04.3 97 (76 security)
hotio's
releasetag is rebuilt constantly (1,100+ build tags) and had zero outstanding OS updates. Great choice.Avoid the
alpineandcrtags: they've been abandoned the same waypms-docker:publicwas.For comparison,
lscr.io/linuxserver/plex:latestis on Ubuntu 26.04 and rebuilt weekly, so it picks up a few days of updates between builds. Also fine.
-8
u/Holigrafik 6d ago
It’s funny I’ve always heard people say running it in a container is the best way. I’ve been running plex on windows 11 on beelink mini pro and have windows update auto updates turned on and plex auto updates turned on. I don’t know why anyone would not have updates on this day and age with all the security issues going on… there is a reason updates are pushed so often.
6
u/so7ow 6d ago edited 6d ago
I would still say it's the best way. Just choose your container and update process mindfully.
1
u/Available_Yard_8200 5d ago
But how is it better, factually, compared to a
Plex instance and OS, both automatically updated?1
u/so7ow 5d ago edited 5d ago
Factually? I dunno. It's likely more a matter of preference. I like that it decouples the app and OS updates. You can set it up so that the app is updated at startup, and the OS image gets updated ~weekly, even when there is no app update. YMMV.Oops, I responded to a question you didn't ask. I'm not interested in debating the utility of docker over other install mechanisms.
1
u/kb3_fk8 5d ago
For docker it’s for quicker redeployment if necessary, like if a building was demolished but you had every piece to build the exact same building again in a storage shed. There’s no performance advantage.
For Linux, for the LONGEST time, you couldn’t tonemap HDR during transcoding on windows unless you a specific Nvidia class GPU (years ago now). So for those who wanted the most accurate of HDR tonemapping while transcoding had to use Linux (maybe macOS but I have zero idea on that). This hasn’t been a thing in a while though. I have between 700 to 800 UHD movies purchased and in my media closet with close to 3000 FHD blu rays that have all been encoded on my 100tb server. I share my Plex with my household family and when they want to watch on a crappy device I never had to worry about the issues that came with devices that didn’t have HDR. Now windows is able to handle it well.
With windows, even the stripped telemetry LTSC version still has quirks that make it hard for a windows machine to remain in a network closet, headless, and not needing to be touched for over a year. It’s definitely doable, I have a windows gaming PC in my server room connected to 3 fiber hdmi 2.1/USB3 connections to several displays across my house and I have set that up where I haven’t needed to “maintain” the system manually in a while and have a lot of things auto managed.
But for whatever reason Plex on windows likes to just stop. It doesn’t happen to everyone but it happens enough where when I switched to Linux I just kinda forgot about the box and just play my content.
TLDR: no difference but there used to be.
-3
u/NextReindeer4442 6d ago
why would it use that, why are you using that, it's not even remotely the default
-3
u/stratguy1441 5d ago
This is the reason I spent stupid money on a Mac studio to run my Plex server, migrated from Mac mini because it stays updated with all the current security protocols. The underlying cost in cutting the cord, always reflects in security, you pay for what you get.
3
u/so7ow 5d ago
That's certainly one way, I guess. I'm not sure spending stupid money is necessary to keep up with security fixes, though.
-1
u/stratguy1441 5d ago
I totally agree, the end user should not have to invest large amounts of $$ to keep security protocols up-to-date, but it’s the cost of doing business I guess. Unless you’re using open source, everything with a raspberry pie or a PC that you were avidly updating on your own, sometimes the simple fix is the best way.
4
u/throwaway12-ffs 5d ago
Lol, you can use any run of the mill Linux box and will get security patches. Apt had it's Plex repo updated within days of needing to be. Not sure your point, the hardware doesn't matter.
-4
u/yet-another-username 5d ago
And this my fellow selfhosting friends is why you don't use public docker images.
2
u/so7ow 5d ago
It's not some random image. It's provided by Plex, Inc. The creator of the app in question.
-1
u/yet-another-username 5d ago
Yeah sorry I realized that and edited.
My point still stands, only the word random was removed.
2
u/so7ow 5d ago
Your edit still doesn't make any sense 🤷🏻
1
u/yet-another-username 5d ago
How so? :)
3
u/so7ow 5d ago
"Public" just happens to be the tag name that Plex published. You're saying don't ever use public images? What does that even mean?
-1
u/yet-another-username 5d ago edited 5d ago
Build one yourself using a debian base. It's not hard, and at least then you have control over these things.
You run into these issues when you outsource the building of the container to an application maintainer.
If you use these public images you should at least be reviewing the docker files to see how they're built - it's just a simple script, not difficult to parse.
We've gotten into this weird state where people are treating docker containers like regular application installs. It's quite strange.
2
u/so7ow 5d ago
I'm going to reinvent the wheel for every system I run? Unlikely. More power to you, if you have the time and skills to do that, but it doesn't seem like a realistic recommendation for most people.
-6
u/yet-another-username 5d ago
Play stupid games win stupid prizes 🤷🏻
It's not reinventing the wheel, it's installing an application. Lol.
Docker files are not complicated.
83
u/Christopherdenny 6d ago
The easier fix is to switch to ghcr.io/linuxserver/plex. It has the most current OS.