misconfiguration here i think is a dangerous way to phrase it… it implies that there is a secure way to run jellyfin on its own. jellyfin, by itself, should never be exposed to the www. it is, no matter the configuration, insecure. to run jellyfin on the www you must put a VPN or other reverse proxy with auth over the top of it
i’d consider that all a good thing, but i can also see how it’s more work
they’re supposed to be stateless because it’s easier to manage, upgrade, etc… if you don’t want that, you can just use load/save/commit (or import/export: can’t remember off the top of my head which is which) and ignore volumes: it amounts to the same thing… there’s also buildpack rebase so you can swap out the base container and keep your top level changes for quick version upgrades that are super simple to roll back