[FEAT] Add abc to correct group for permissions to /dev/dri

[bmbvenom]

Is this a new feature request?

• I have searched the existing issues

Wanted change

Image: linuxserver/nextcloud:31.0.5

When setting up transcoding in the Memories app in Nextcloud I kept running into "incorrect permissions" errors for /dev/dri. I see in this issue for linuxserver/docker-plex that it was recommended to use a script to get it to work. As I understand it the script adds the abc user to the correct group to get access to /dev/dri on the host system. I've run this script in my container and it does work, but I'd like to see that functionality added to the linuxserver/docker-nextcloud.

FYI it looks like the current mechanism for docker-plex is different than it was when that issue was opened.

Thanks!

Reason for change

Hardware transcoding doesn't work like it does in other linuxserver projects.

Proposed code change

No response

[github-actions]

Thanks for opening your first issue here! Be sure to follow the relevant issue templates, or risk having this issue marked as invalid.

[j0nnymoe]

You shouldn't need to do any more than what's listed in the memories readme here https://memories.gallery/hw-transcoding/#docker (scroll down to where it specifically talks about our container) - also worth noting, if you're wanting Nvidia with our nextcloud container, it's not an option.

[bmbvenom]

Thank you for the quick reply! I already have those lines specific to the linuxserver container in my compose file:

devices:
  - /dev/dri:/dev/dri
environment:
  - DOCKER_MODS=linuxserver/mods:universal-package-install
  - INSTALL_PACKAGES=libva|libva-intel-driver|intel-media-driver|mesa-va-gallium

But I am still getting the error:

VA-API device (/dev/dri/renderD128) has incorrect permissions

I can get around this by running the script I originally linked inside the container, but I would have to do that every time the container is re-created. I believe a script like the one linked above still needs to be added to the linuxserver image for transcoding to work seamlessly.

[j0nnymoe]

I'll test on my instance when I get a chance. I'm pretty sure I never had to do any additional bits to make it work before.

[bmbvenom]

Thank you, I appreciate it. It's entirely possible that I'm just doing something wrong.

[aptalca]

Set this env var
ATTACHED_DEVICES_PERMS="/dev/dri -type c"

[bmbvenom]

@aptalca I just tried adding that env var and unfortunately it still did not work. I assume that is supposed to run this script on container start? Just to test, I confirmed the env var is set correctly and manually downloaded/ran the script and the script itself works. It just isn't running on container creation like I think it's supposed to. The below is from a completely fresh container:

root@a26b225c79fc:/# env | grep ATTACHED_DEVICES_PERMS
ATTACHED_DEVICES_PERMS=/dev/dri -type c
root@a26b225c79fc:/# id abc
uid=1000(abc) gid=1000(users) groups=1000(users),1000(users)
root@a26b225c79fc:/# cd /tmp
root@a26b225c79fc:/tmp# curl -O https://raw.githubusercontent.com/linuxserver/docker-baseimage-alpine/refs/heads/master/root/etc/s6-overlay/s6-rc.d/init-device-perms/run
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  1778  100  1778    0     0  10135      0 --:--:-- --:--:-- --:--:-- 10160
root@a26b225c79fc:/tmp# chmod +x run
root@a26b225c79fc:/tmp# ./run
**** creating group groupidx9 with id 44 ****
**** adding /dev/dri/card1 to group groupidx9 with id 44 ****
**** creating group groupkyr5 with id 103 ****
**** adding /dev/dri/renderD128 to group groupkyr5 with id 103 ****
root@a26b225c79fc:/tmp# id abc
uid=1000(abc) gid=1000(users) groups=1000(users),1000(users),44(groupidx9),103(groupkyr5)

[aptalca]

Post the compose yaml and full container log

[bmbvenom]

Relevant section of compose YAML (excluded redis, mariadb, collabora-code)

services:
  nextcloud:
    image: ghcr.io/linuxserver/nextcloud:31.0.5
    container_name: nextcloud_app
    networks:
      - nextcloud_network
    depends_on:
      - mariadb
      - redis
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=America/Los_Angeles
      - DOCKER_MODS=linuxserver/mods:universal-package-install
      - INSTALL_PACKAGES=libva|libva-intel-driver|intel-media-driver|mesa-va-gallium
      - 'ATTACHED_DEVICES_PERMS=/dev/dri -type c'
    volumes:
      - /opt/nextcloud/config:/config
      - /opt/nextcloud/data:/data
    devices:
      - "/dev/dri:/dev/dri"
    ports:
      - 9443:443
    restart: unless-stopped
networks:
  nextcloud_network:

Logs

[mod-init] Running Docker Modification Logic                                                                                                                [mod-init] Adding linuxserver/mods:universal-package-install to container
[mod-init] Downloading linuxserver/mods:universal-package-install from lscr.io
[mod-init] Installing linuxserver/mods:universal-package-install
[mod-init] linuxserver/mods:universal-package-install applied to container
[migrations] started
[migrations] 01-nginx-site-confs-default: skipped
[migrations] 02-default-location: skipped
[migrations] done
───────────────────────────────────────                                                                                                                     
      __┐     _______┐__┐ ______┐
      __│     __┌────┘__│__┌───__┐
      __│     _______┐__│__│   __│
      __│     └────__│__│__│   __│
      _______┐_______│__│└______┌┘
      └──────┘└──────┘└─┘ └─────┘                                                                                                                           
   Brought to you by linuxserver.io
───────────────────────────────────────                                                                                                                     
To support LSIO projects visit:
https://www.linuxserver.io/donate/

───────────────────────────────────────                                                                                                                     GID/UID
───────────────────────────────────────                                                                                                                     
User UID:    1000
User GID:    1000
───────────────────────────────────────                                                                                                                     Linuxserver.io version: 31.0.5-ls380
Build-date: 2025-05-15T13:06:11+00:00
───────────────────────────────────────                                                                                                                     
using keys found in /config/keys
**** The following active confs have different version dates than the samples that are shipped. ****
**** This may be due to user customization or an update to the samples. ****
**** You should compare the following files to the samples in the same folder and update them. ****
**** Use the link at the top of the file to view the changelog. ****
┌────────────_────────────_────────────────────────────────────────────────────────────────────────┐
│  old date  │  new date  │ path                                                                   │
├────────────┼────────────┼────────────────────────────────────────────────────────────────────────┤
│ 2023-08-13 │ 2024-12-06 │ /config/nginx/ssl.conf                                                 │
│ 2024-05-27 │ 2024-12-17 │ /config/nginx/nginx.conf                                               │
└────────────┴────────────┴────────────────────────────────────────────────────────────────────────┘                                                        **** The following site-confs have extensions other than .conf ****
**** This may be due to user customization. ****
**** You should review the files and rename them to use the .conf extension or remove them. ****
**** nginx.conf will only include site-confs with the .conf extension. ****
/config/nginx/site-confs/default.conf_20241217
Initializing nextcloud 31.0.5.1 (this can take a while) ...
Setting permissions
Initializing finished
**** Adding libva to OS package install list ****
**** Adding libva-intel-driver to OS package install list ****
**** Adding intel-media-driver to OS package install list ****
**** Adding mesa-va-gallium to OS package install list ****
[pkg-install-init] **** Installing all mod packages ****
fetch http://dl-cdn.alpinelinux.org/alpine/v3.21/main/x86_64/APKINDEX.tar.gz
fetch http://dl-cdn.alpinelinux.org/alpine/v3.21/community/x86_64/APKINDEX.tar.gz
(1/9) Installing intel-gmmlib (22.5.4-r0)
(2/9) Installing intel-media-driver (24.4.3-r0)
(3/9) Installing libva-intel-driver (2.4.1-r2)
(4/9) Installing llvm19-libs (19.1.4-r1)
(5/9) Installing libelf (0.191-r0)
(6/9) Installing mesa-glapi (24.2.8-r0)
(7/9) Installing libxshmfence (1.3.2-r6)
(8/9) Installing mesa (24.2.8-r0)
(9/9) Installing mesa-va-gallium (24.2.8-r0)
OK: 631 MiB in 329 packages
[custom-init] No custom files found, skipping...
[ls.io-init] done.

[aptalca]

Repull the image and recreate the container. The perm fixing was just added a few days ago. You likely have an older image.

[bmbvenom]

🤦 Indeed that was it, I had an old image. My image was only 1 day older than the permissions merge to base last week, my timing couldn't have been much better, eh? Pulled the new image and everything works great with that env var defined. The logs now show the following and Memories is happy.

**** creating group groupus9m with id 44 ****
**** adding /dev/dri/card1 to group groupus9m with id 44 ****
**** creating group groupbhzx with id 103 ****
**** adding /dev/dri/renderD128 to group groupbhzx with id 103 ****

Thank you both so very much for your incredibly prompt and comprehensive support! ❤