Error when running through quadlet but not from CLI

[asagent7]

Hi, I am able to run frigate successfully from cli, but when I try to enable frigate with podman quadlet, ffmpeg fails because it's not able to find the gpu for hw acceleration giving the following error

ERROR : [AVHWDeviceContext @ 0x55c6324db500] No VA display found for device /dev/dri/renderD128. ERROR : Device creation failed: -22. ERROR : [h264 @ 0x55c632650bc0] No device available for decoder: device type vaapi needed for codec h264.

My quadlet config is as follows:

[Container]
ContainerName=frigate
Image=ghcr.io/blakeblackshear/frigate:stable
PublishPort=5000:5000
PublishPort=8554:8554
Volume=%h/podman/frigate:/config
Volume=/mnt/frigate:/media/frigate
AutoUpdate=registry
#NoNewPrivileges=true
Network=IoT.network
PodmanArgs=--group-add=keep-groups
AddDevice=/dev/dri/renderD128:/dev/dri/renderD128
AddDevice=/dev/bus/usb/002/004:/dev/bus/usb/002/004
#AddCapability=PERFMON
Timezone=local
Tmpfs=/tmp/cache:size=1000000000

[Service]
Restart=always

[Install]
WantedBy=default.target

When I do a dryrun and use the generated podman command directly in the cli, it works flawlessly:

podman run --name=frigate --cidfile=./abc.cid --replace --rm --cgroups=split --tz=local --network=IoT --sdnotify=conmon -d --device=/dev/dri/renderD128:/dev/dri/renderD128 --device=/dev/bus/usb/002/004:/dev/bus/usb/002/004 --tmpfs /tmp/cache:size=1000000000 -v /home/adam/podman/frigate:/config -v /mnt/frigate:/media/frigate --label io.containers.autoupdate=registry --publish 5000:5000 --publish 8554:8554 --group-add=keep-groups ghcr.io/blakeblackshear/frigate:stable

I am not able to figure out why it would work from cli but not when started as systemd service using quadlet. Any idea what I am missing?

Podman version is 4.9.3 on debian bookworm.

If it helps, had to add my user to render group in order to make it work from cli which let frigate access the gpu. I think somehow group-add=keep-groups is not being respected

[Luap99]

Did you reboot? The systemd user session is started early when you log in (or at boot with lingering) so it does not have access to groups that were added later.

[asagent7]

Thanks. This solved it. I had not had to reboot for any other container till now, so I did not even consider. I had logged out and back after adding the user to the group, so I thought that should be taking care of the groups