immich-app/immich
1
0
Fork 0
mirror of https://github.com/immich-app/immich.git synced 2026-07-25 14:00:45 +03:00
Code Issues 783 Packages Projects Releases 22 Wiki Activity

Access to /dev/dri/renderD128 fails in immich-server docker container #4576

New Issue
Closed
opened 2026-02-05 10:41:57 +03:00 by OVERLORD · 0 comments
OVERLORD commented 2026-02-05 10:41:57 +03:00
Owner
Copy Link

Originally created by @scherddel on GitHub (Oct 17, 2024).

Summary of the Issue:

I'm experiencing a permission issue when trying to access /dev/dri/renderD128 inside a Docker container that runs within an unprivileged LXC container on a Proxmox 8.2 host. The host hardware includes a CPU with an integrated GPU (amd, Ryzen 5 7600), which I want to use for transcoding tasks inside the Docker container using VAAPI.

Environment:

  • Host: Proxmox VE 8.2 with an iGPU (amd).
  • LXC Container:
    • Unprivileged container.
    • Mapped the render group GID to align with the host. (see below)
    • Configured to pass through /dev/dri devices.
  • Docker Container:
    • Runs inside the LXC container.
    • Hosts a immich-server, started from the default docker-compose.yml

Problem Description:

  • The transcoding application inside the Docker container fails with an error when attempting to access /dev/dri/renderD128.
[Nest] 7  - 10/17/2024, 9:15:53 AM   ERROR [Microservices:MediaRepository] ffmpeg version 7.0.2-Jellyfin Copyright (c) 2000-2024 the FFmpeg developers
  built with gcc 12 (Debian 12.2.0-14)
  configuration: --prefix=/usr/lib/jellyfin-ffmpeg --target-os=linux --extra-version=Jellyfin --disable-doc --disable-ffplay --disable-ptx-compression --disable-static --disable-libxcb --disable-sdl2 --disable-xlib --enable-lto=auto --enable-gpl --enable-version3 --enable-shared --enable-gmp --enable-gnutls --enable-chromaprint --enable-opencl --enable-libdrm --enable-libxml2 --enable-libass --enable-libfreetype --enable-libfribidi --enable-libfontconfig --enable-libharfbuzz --enable-libbluray --enable-libmp3lame --enable-libopus --enable-libtheora --enable-libvorbis --enable-libopenmpt --enable-libdav1d --enable-libsvtav1 --enable-libwebp --enable-libvpx --enable-libx264 --enable-libx265 --enable-libzvbi --enable-libzimg --enable-libfdk-aac --arch=amd64 --enable-libshaderc --enable-libplacebo --enable-vulkan --enable-vaapi --enable-amf --enable-libvpl --enable-ffnvcodec --enable-cuda --enable-cuda-llvm --enable-cuvid --enable-nvdec --enable-nvenc
  libavutil      59.  8.100 / 59.  8.100
  libavcodec     61.  3.100 / 61.  3.100
  libavformat    61.  1.100 / 61.  1.100
  libavdevice    61.  1.100 / 61.  1.100
  libavfilter    10.  1.100 / 10.  1.100
  libswscale      8.  1.100 /  8.  1.100
  libswresample   5.  1.100 /  5.  1.100
  libpostproc    58.  1.100 / 58.  1.100
Routing option strict to both codec and muxer layer
[AVHWDeviceContext @ 0x52b0c120280] Failed to open /dev/dri/renderD128 as DRM device node.
[AVHWDeviceContext @ 0x52b0c120280] No VA display found for device /dev/dri/renderD128.
Device creation failed: -22.
Failed to set value 'vaapi=accel:/dev/dri/renderD128' for option 'init_hw_device': Invalid argument
Error parsing global options: Invalid argument

[Nest] 7  - 10/17/2024, 9:15:53 AM   ERROR [Microservices:MediaService] Error occurred during transcoding: ffmpeg exited with code 234: Device creation failed: -22.
Failed to set value 'vaapi=accel:/dev/dri/renderD128' for option 'init_hw_device': Invalid argument
Error parsing global options: Invalid argument

[Nest] 7  - 10/17/2024, 9:15:53 AM   ERROR [Microservices:MediaService] Retrying with VAAPI acceleration disabled
  • Running cat /dev/dri/renderD128 inside the Docker container also results in "Permission denied".
  • If I change the permissions of /dev/dri/renderD128 on the host to 666 (chmod 666 /dev/dri/renderD128), the transcoding application works as expected.
  • However, changing permissions to 666 is not secure and not an acceptable long-term solution.

Findings:

  • The device node /dev/dri/renderD128 inside the Docker container is being overmounted with tmpfs and devtmpfs, which replaces the host's device node and its permissions.

  • Overmounting occurs even without udev or systemd running inside the container.

  • Changing the permissions to 666 on the host allows access because it grants universal read/write permissions, but this is insecure.

  • Device Node Permissions Inside Docker Container:

    ls -l /dev/dri/renderD128

    Output:

    crw-rw---- 1 nobody render 226, 128 Oct 14 21:00 /dev/dri/renderD128

Additional Notes:

  • Security Considerations:

    • Changing device permissions to 666 on the host is not acceptable due to security risks.
    • Need a solution that maintains proper security while allowing the Docker container to access the iGPU.

Any help or suggestions would be greatly appreciated.

The OS that Immich Server is running on

Promox 8.2.7 running an Alpine 2.19 LXC running docker

Version of Immich Server

latest

Version of Immich Mobile App

latest

Platform with the issue

  • Server
  • Web
  • Mobile

Your docker-compose.yml content

latest

Your .env content

latest

Reproduction steps

  1. Upload a .MOV file to Immich
  2. Transcoding Starts using VAAPI
  3. Error occurs and transcoding handled by cpu instead.

Relevant log output

No response

Additional information

No response

Originally created by @scherddel on GitHub (Oct 17, 2024). **Summary of the Issue:** I'm experiencing a permission issue when trying to access `/dev/dri/renderD128` inside a Docker container that runs within an unprivileged LXC container on a Proxmox 8.2 host. The host hardware includes a CPU with an integrated GPU (amd, Ryzen 5 7600), which I want to use for transcoding tasks inside the Docker container using VAAPI. **Environment:** - **Host:** Proxmox VE 8.2 with an iGPU (amd). - **LXC Container:** - Unprivileged container. - Mapped the `render` group GID to align with the host. (see below) - Configured to pass through `/dev/dri` devices. - **Docker Container:** - Runs inside the LXC container. - Hosts a immich-server, started from the default docker-compose.yml **Problem Description:** - The transcoding application inside the Docker container fails with an error when attempting to access `/dev/dri/renderD128`. ```bash [Nest] 7 - 10/17/2024, 9:15:53 AM ERROR [Microservices:MediaRepository] ffmpeg version 7.0.2-Jellyfin Copyright (c) 2000-2024 the FFmpeg developers built with gcc 12 (Debian 12.2.0-14) configuration: --prefix=/usr/lib/jellyfin-ffmpeg --target-os=linux --extra-version=Jellyfin --disable-doc --disable-ffplay --disable-ptx-compression --disable-static --disable-libxcb --disable-sdl2 --disable-xlib --enable-lto=auto --enable-gpl --enable-version3 --enable-shared --enable-gmp --enable-gnutls --enable-chromaprint --enable-opencl --enable-libdrm --enable-libxml2 --enable-libass --enable-libfreetype --enable-libfribidi --enable-libfontconfig --enable-libharfbuzz --enable-libbluray --enable-libmp3lame --enable-libopus --enable-libtheora --enable-libvorbis --enable-libopenmpt --enable-libdav1d --enable-libsvtav1 --enable-libwebp --enable-libvpx --enable-libx264 --enable-libx265 --enable-libzvbi --enable-libzimg --enable-libfdk-aac --arch=amd64 --enable-libshaderc --enable-libplacebo --enable-vulkan --enable-vaapi --enable-amf --enable-libvpl --enable-ffnvcodec --enable-cuda --enable-cuda-llvm --enable-cuvid --enable-nvdec --enable-nvenc libavutil 59. 8.100 / 59. 8.100 libavcodec 61. 3.100 / 61. 3.100 libavformat 61. 1.100 / 61. 1.100 libavdevice 61. 1.100 / 61. 1.100 libavfilter 10. 1.100 / 10. 1.100 libswscale 8. 1.100 / 8. 1.100 libswresample 5. 1.100 / 5. 1.100 libpostproc 58. 1.100 / 58. 1.100 Routing option strict to both codec and muxer layer [AVHWDeviceContext @ 0x52b0c120280] Failed to open /dev/dri/renderD128 as DRM device node. [AVHWDeviceContext @ 0x52b0c120280] No VA display found for device /dev/dri/renderD128. Device creation failed: -22. Failed to set value 'vaapi=accel:/dev/dri/renderD128' for option 'init_hw_device': Invalid argument Error parsing global options: Invalid argument [Nest] 7 - 10/17/2024, 9:15:53 AM ERROR [Microservices:MediaService] Error occurred during transcoding: ffmpeg exited with code 234: Device creation failed: -22. Failed to set value 'vaapi=accel:/dev/dri/renderD128' for option 'init_hw_device': Invalid argument Error parsing global options: Invalid argument [Nest] 7 - 10/17/2024, 9:15:53 AM ERROR [Microservices:MediaService] Retrying with VAAPI acceleration disabled ``` - Running `cat /dev/dri/renderD128` inside the Docker container also results in "Permission denied". - If I change the permissions of `/dev/dri/renderD128` on the **host** to `666` (`chmod 666 /dev/dri/renderD128`), the transcoding application works as expected. - However, changing permissions to `666` is not secure and not an acceptable long-term solution. **Findings:** - The device node `/dev/dri/renderD128` inside the Docker container is being overmounted with `tmpfs` and `devtmpfs`, which replaces the host's device node and its permissions. - Overmounting occurs even without `udev` or `systemd` running inside the container. - Changing the permissions to `666` on the host allows access because it grants universal read/write permissions, but this is insecure. - **Device Node Permissions Inside Docker Container:** ```bash ls -l /dev/dri/renderD128 ``` Output: ``` crw-rw---- 1 nobody render 226, 128 Oct 14 21:00 /dev/dri/renderD128 ``` **Additional Notes:** - **Security Considerations:** - Changing device permissions to `666` on the host is not acceptable due to security risks. - Need a solution that maintains proper security while allowing the Docker container to access the iGPU. **Any help or suggestions would be greatly appreciated.** ### The OS that Immich Server is running on Promox 8.2.7 running an Alpine 2.19 LXC running docker ### Version of Immich Server latest ### Version of Immich Mobile App latest ### Platform with the issue - [X] Server - [ ] Web - [ ] Mobile ### Your docker-compose.yml content ```YAML latest ``` ### Your .env content ```Shell latest ``` ### Reproduction steps 1. Upload a .MOV file to Immich 2. Transcoding Starts using VAAPI 3. Error occurs and transcoding handled by cpu instead. ### Relevant log output _No response_ ### Additional information _No response_
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
accessibility
changelog:enhancement
changelog:security
changelog:skip
changelog:translation
cli
date-time
dependencies
documentation
external-library
format
good first issue
mobile-beta
mobile-beta
mobile-beta
needs-answer
nice to have
pull-request
Mirrored from GitHub Pull Request
 sharing
tech-debt
📱mobile
🖥️web
🗄️server
🧠machine-learning
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
OVERLORD
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: immich-app/immich#4576
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?