qBittorrent

Last reviewed Sep 13, 2026 · 781 words

The one setting that decides whether a headless qBittorrent install is safe is Advanced, Network interface, and it should say the name of your VPN tunnel and nothing else. With that set, qBittorrent stops transferring the moment the tunnel drops instead of falling back to your real connection, and every other hardening step is secondary. Everything else about it is straightforward: 50 MB of RAM, a complete web UI, RSS automation, a built-in search, and no ads or bundled extras, which is the whole reason a 39,892-star GPL client displaced the paid ones. If you run Sonarr and Radarr, it is the download client I would pick without much deliberation.

First run: the password is in the logs

Since version 4.6.1 there is no default admin / adminadmin. The container generates a temporary password and prints it once in the log at startup, so docker logs qbittorrent is the first command after up. Set a permanent password immediately under Web UI options, and while there, turn on "Bypass authentication for clients on localhost" only if nothing else on that host can reach the port. The LinuxServer image is the one most people run:

services:
  qbittorrent:
    image: lscr.io/linuxserver/qbittorrent:latest
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=Europe/London
      - WEBUI_PORT=8080
    volumes:
      - ./config:/config
      - /srv/data:/data
    ports:
      - 8080:8080
      - 6881:6881
      - 6881:6881/udp
    restart: unless-stopped

Port 6881 is the listening port; forward it on your router or through the VPN provider's port forwarding if they offer it, or accept slower speeds on private trackers. Behind a VPN container you drop the ports block for 6881 and attach qBittorrent to the VPN container's network instead.

One volume, so hardlinks work

The single most common mistake in an arr stack is mounting /downloads and /media as two separate volumes. Sonarr then cannot hardlink a finished episode into the library and copies it instead, doubling disk use and breaking seeding. Mount one parent, /data above, with torrents and media inside it, and give every container the same mapping. The arr stack explainer covers the folder layout in detail; it is 10 minutes of planning that saves a disk.

Then set Torrent Management Mode to Automatic and create categories, tv, movies, music, each with its own save path under /data/torrents. Sonarr and Radarr send their category with each download, qBittorrent files it in the right place, and the import step just works. Leave the default category blank so manual downloads land somewhere you look.

RSS rules and search are the two features Transmission lacks

The built-in RSS downloader takes a feed and a regex rule and downloads matches, which for anything the arr tools do not cover, a podcast archive, a Linux distro's release feed, a private tracker's freeleech feed, replaces a whole automation. The search plugin system queries public indexers from inside the client, useful once, then replaced by Prowlarr the moment you run more than one app. Transmission is lighter still and rock solid, but it has neither, and its web UI is a fraction of this one. Deluge matches on plugins and loses on polish. For a headless server that feeds a Jellyfin library, qBittorrent is the default and the other two are for people with a specific reason.

Settings that are worth touching, and the many that aren't

The catalogue is right that the settings can overwhelm; the client exposes hundreds. Five that matter: the network interface binding above; a global upload limit around 80% of your uplink so the house's video calls survive; seeding limits per category (ratio 2.0 or 7 days is polite on public trackers and required on private ones); "Pre-allocate disk space" on for spinning disks; and the connection limit dropped to about 200 on a router that struggles with NAT tables. Leave the rest alone. Encryption mode, disk cache and queueing defaults are sensible.

Backups are one small directory

Everything, torrents in progress included, lives in /config. Copy it while the container is stopped and a restore resumes exactly where it left off, provided the data volume path is the same. Ten megabytes, nightly, no excuses.

What I'd do

LinuxServer image, bound to the VPN interface, one /data volume shared with Sonarr and Radarr, categories set, temporary password rotated on minute one, Prowlarr for search, RSS rules for the two feeds nothing else handles. That is a torrent server that runs for years untouched at 50 MB of RAM. Choose Transmission only if you need the absolute minimum on a Raspberry Pi and never plan to automate.