Your head might be spinning from all the different advice you’re getting - don’t worry, there are a lot of options and lots of folk are jumping in with genuinely good (and well meaning) advice. I guess I’ll add my two cents, but try and explain the ‘why’ of my thinking.

I’m assuming from your questions you know your way around a computer, can figure things out, but haven’t done much self-hosting. If I’m wrong about that, go ahead and skip this suggestion.

• Jellyfin good - a common gateway drug to homelabbing, and the only thing you’ll do that non-tech friends will appreciate
• Proxmox good - it makes the backups simple and provides a path forward for all sorts of things
• Docker good - you’ve said it increases complexity; this is correct in that you’re adding more layers of stuff, but it reduces your complexity of management by removing a heap of dependency issues. There is a compute and memory overhead involved, but it’s small and the tradeoff is worth it.
• VM good - yes an LXC is more efficient, but it’s harder to run docker in. Save that for a future project
• Media data somewhere else good - I run a separate NAS with an SMB share. A NAS in a VM is a compromise, but like all things self hosting, you start out with what you’ve got. I let Jellyfin keep the metadata in the VM that’s hosting my Jellyfin though since the NAS is over the network. That’s less of a consideration if you are visualizing your NAS on the same machine, but I’d still do it my way for future proofing.
• Passthrough magic not yet - this can also be a future project. If your metal has quicksync that can be utilized to reduce the CPU load, but that can also be a future project.

My experience with LXC hasn’t been ideal, but for reasons that are by design. The permissions make it complicated for the way I use it. Proxmox has all of the storage, which is shared with the LXC as a Mount Point. The LXC has unique user PIDs and GIDs, so if the LXC modifies a file, now none of my other stuff has permission to access it.

I had to add some config stuff to get around this problem, but in the end I just switched to VMs. I don’t care about overhead that much.

Edit to add more info: I think the permissions problem is only if you make the container “unprivileged”. The relevant config to add to /etc/pve/lxc/***.conf is as follows:

unprivileged: 1
lxc.idmap: u 0 100000 1000
lxc.idmap: g 0 100000 1000
lxc.idmap: u 1000 1000 1
lxc.idmap: g 1000 1000 1
lxc.idmap: u 1001 101001 64535
lxc.idmap: g 1001 101001 64535 

I have no clue why this works. I think I copied it from Proxmox documentation. It worked and I left it at that.

Docker lets the maintainers configure all of the dependencies for you. You then don’t need to worry about whether you’re using debian, ubuntu or even fedora. When you upgrade jellyfin you just pick the new tag to pull without worrying about whether it needs a new version of ffmpeg or if it works with avconv.

It gets you out of the business of trying to maintain compatibility and just keeping your os up to date.

Feel free to use lxc though. I had issues with using lxc that I couldn’t work around so I use cloudinit ubuntu/debian images instead. I think the issue I had was actually using NFS but I don’t remember…