Jellyfin in Podman hw acceleration not working after systemd start

[Damncold]

Hi folks,

I installed jellyfin via podman on a debian vm.

aftter some struggle i managed to get hw accelaration (iGPU - QSV/VAAPI) of my i5 6500 working.
But it works only when i start it via podman run:

podman run -d \
--label "io.containers.autoupdate=registry" \
--name jellyfin \
--publish 8096:8096/tcp \
-p 7359:7359/udp `#optional - server discovery on local network` \
-p 1900:1900/udp `#optional - dlna server discovery on local network` \
-e JELLYFIN_PublishedServerUrl=10.3.100.5 `#optional - autodiscovery response domain` \
-e TZ=Europe/Berlin \
--user $(id -u):$(id -g) \
--userns keep-id \
--group-add keep-groups \
--device=/dev/dri/:/dev/dri/ \
--volume /home/marco/docker/appdata/jellyfin/cache:/cache \
--volume /home/marco/docker/appdata/jellyfin/config:/config \
--mount type=bind,source=/mnt/nvme/jellyfin/Serien,destination=/media/shows,ro=false,relabel=private \
--mount type=bind,source=/mnt/nvme/jellyfin/Filme,destination=/media/movies,ro=false,relabel=private \
docker.io/jellyfin/jellyfin:latest

as soon as i try to start it with the podman generated systemd file
i get the playback error, that my client isnt compatible ...

anyone here who can help me with this? :>
i already read some thing about systemd hardening ... i think some permissions are missing, but i dont know how to change the system.d file to get it working again .

Tried this in the .service file:
PrivateDevices=false
DeviceAllow=/dev/dri/renderD128

but didnt helped.

complete systemd-file:

cat ~/.config/systemd/user/jellyfin.service
# container-jellyfin.service
# autogenerated by Podman 4.5.1
# Mon Oct  9 22:22:22 CEST 2023

[Unit]
Description=Podman container-jellyfin.service
Documentation=man:podman-generate-systemd(1)
Wants=network-online.target
After=network-online.target
RequiresMountsFor=%t/containers

[Service]
Environment=PODMAN_SYSTEMD_UNIT=%n
Restart=always
TimeoutStopSec=70
ExecStart=/usr/bin/podman run \
        --cidfile=%t/%n.ctr-id \
        --cgroups=no-conmon \
        --rm \
        --sdnotify=conmon \
        --replace \
        -d \
        --label io.containers.autoupdate=registry \
        --name jellyfin \
        --publish 8096:8096/tcp \
        -p 7359:7359/udp \
        -p 1900:1900/udp \
        -e JELLYFIN_PublishedServerUrl=10.3.100.5 \
        -e TZ=Europe/Berlin \
        --user 1000:1000 \
        --userns keep-id \
        --group-add keep-groups \
        --device=/dev/dri/:/dev/dri/ \
        --volume /home/marco/docker/appdata/jellyfin/cache:/cache \
        --volume /home/marco/docker/appdata/jellyfin/config:/config \
        --mount type=bind,source=/mnt/nvme/jellyfin/Serien,destination=/media/shows,ro=false,relabel=private \
        --mount type=bind,source=/mnt/nvme/jellyfin/Filme,destination=/media/movies,ro=false,relabel=private docker.io/jellyfin/jellyfin:latest
ExecStop=/usr/bin/podman stop \
        --ignore -t 10 \
        --cidfile=%t/%n.ctr-id
ExecStopPost=/usr/bin/podman rm \
        -f \
        --ignore -t 10 \
        --cidfile=%t/%n.ctr-id
Type=notify
NotifyAccess=all
PrivateDevices=false
DeviceAllow=/dev/dri/renderD128

[Install]
WantedBy=default.target

[rhatdan]

Could you try this as a quadlet instead of podman generate systemd?

[luebke-dev]

I found the error its a SELinux issue running the service with SecurityLabelDisable=true fixed it for me.

[rhatdan]

Do you have the SELinux AVC messages?

[luebke-dev]

type=AVC msg=audit(1703548434.252:440): avc:  denied  { open } for  pid=2155 comm="ffmpeg" path="/dev/dri/renderD128" dev="devtmpfs" ino=724 scontext=system_u:system_r:container_t:s0:c466,c655 tcontext=system_u:object_r:dri_device_t:s0 tclass=chr_file permissive=0
type=AVC msg=audit(1703548434.521:441): avc:  denied  { open } for  pid=2157 comm="ffmpeg" path="/dev/dri/renderD128" dev="devtmpfs" ino=724 scontext=system_u:system_r:container_t:s0:c466,c655 tcontext=system_u:object_r:dri_device_t:s0 tclass=chr_file permissive=0
type=AVC msg=audit(1703548434.702:442): avc:  denied  { open } for  pid=2158 comm="ffmpeg" path="/dev/dri/renderD128" dev="devtmpfs" ino=724 scontext=system_u:system_r:container_t:s0:c466,c655 tcontext=system_u:object_r:dri_device_t:s0 tclass=chr_file permissive=0

[luebke-dev]

And thats the quadlet i use:

[Unit]
Description=jellyfin

[Container]
Image={{ jellyfin_image }}
AutoUpdate=registry
ContainerName=jellyfin
UserNS=keep-id
SecurityLabelDisable=true
AddDevice=/dev/dri/:/dev/dri/
Volume=/var/home/jellyfin/config:/config:rw,z
Volume=/var/home/jellyfin/media:/mnt/media:rw,z
PublishPort=127.0.0.1:8096:8096

[Install]
WantedBy=multi-user.target

[rhatdan]

Rather then turn off SELinux separation, you can set the container_use_dri_device boolean on.

sudo setsebool -P container_use_dri_device 1

Then you can run with SELinux confinement.

[rhatdan]

rpm -q container-selinux
container-selinux-2.226.0-1

[luebke-dev]

rpm -q container-selinux
container-selinux-2.224.0-1.fc39.noarch

[rhatdan]

Does the boolean exist with that version?

[luebke-dev]

unfortunately not

[rhatdan]

Should be avalable in updates.

dnf -y update --enablerepo updates-testing container-selinux