[FIX] Please add Command to your proxmox script to fix Hardware transcoding issue

[G5K-org]

Please add this command to your jellyfin install script:
chmod 666 /dev/dri/renderD128

Problem:
Hardware Transcoding via Intel VAAPI does not work.

Solution:
I changed
crw-rw---- 1 root sgx 226, 128 Sep 21 17:43 /dev/dri/renderD128
with chmod 666 /dev/dri/renderD128
inside the lxc container
to
crw-rw-rw- 1 root sgx 226, 128 Sep 21 17:43 /dev/dri/renderD128

now it works fine.

[tteck]

Typically, device files related to Direct Rendering Infrastructure (DRI), such as /dev/dri/renderD128, are usually assigned to the "render" group. This allows users who are part of the "render" group to access and use the graphics rendering capabilities provided by these devices.

crw-rw---- 1 root render 226, 128 Sep 25 13:15 renderD128

[tteck]

The group ownership of /dev/dri/renderD128 should ideally be "render" instead of "sgx" if it's following standard conventions.

Maybe you should try a chown :render /dev/dri/renderD128?

Is it possible that in your specific system configuration, it was assigned to a different group like "sgx" for specific reasons or requirements?

[tteck]

If I'm not mistaken, the correct file permissions for /dev/dri/renderD128 should be 660 as it grants read and write permissions to the owner and the group but denies all permissions to others. By using 666 it grants read and write permissions to everyone, including the owner, group, and others.

[tteck]

In summary, the problem doesn't lie with the script itself, but rather with the incorrect group assignment, which prompted you to make permission changes. I recommend utilizing the "render" group and setting file permissions to 660.

[di5cord20]

Not sure if I'm configured correctly. Proxmox is installed on a mini pc with an N100 CPU. Looks like the pve node group is set to Render but the LXC containers for Jellyfin & Plex are set to ssl-cert.

Main pve node:

root@pve:/dev/dri# ls -l
total 0
drwxr-xr-x 2 root root         80 Sep 25 00:31 by-path
crw-rw---- 1 root video  226,   0 Sep 25 00:31 card0
crw-rw---- 1 root render 226, 128 Sep 25 00:31 renderD128

LXC containers using your scripts for both Jellyfin/Plex:

root@jellyfin:/dev/dri# ls -l
total 0
drwxr-xr-x 2 root root           80 Sep 25 00:31 by-path
crw-rw---- 1 root video    226,   0 Sep 25 00:31 card0
crw-rw---- 1 root ssl-cert 226, 128 Sep 25 00:31 renderD128

[joaomajesus]

Sorry that I can't find the source atm, but I once looked into this and the issue seems to be related to the fact that the SID of the render group is different between the host and the container.
So, in this case the SID for render on the host is the same as the SID for ssl-cert in the container.
There are some settings you can add to the container .conf file in pve to map the groups/users to the correct ones,

[tteck]

Is this what you're thinking about?

adduser $(id -u -n) video && adduser $(id -u -n) render

this command adds the current user to both the "video" and "render" groups

[joaomajesus]

no. 😄
After a quick search I found what I was talking about:
Unprivileged LXC containers
Basically, this affects Unprivileged Containers. For those, pve uses a different range for the GIDs and UIDs.
I'm not sure if your Script creates the Jellyfin Container as Unprivileged, but I hope this helps.

[tteck]

Nope, privileged

[joaomajesus]

Then I suppose something more is going on. In that case the GIDs should be the same. But that is not what is being reported here.

[tteck]

Need testers #2523 (comment)