[BUG] Render group not mapped correctly to own card with intel GPU passthrough

[m-m-adams]

Is there an existing issue for this?

• I have searched the existing issues

Current Behavior

Seems to be a duplicate of #211 however I am actually using your docker image. The device renderD128 is owned by the render group on my host but the docker container leaves that as group 104 without mapping it to render. The plex webui sees the GPU and allows me to select it but won't actually be able to use it for transcoding

Jul 08, 2025 22:57:27.912 [128038606003000] DEBUG - [Req#2c7/Transcode] Codecs: hardware transcoding: testing API vaapi for device '/dev/dri/renderD128' (Intel Alder Lake-UP3 GT2 [UHD Graphics])
Jul 08, 2025 22:57:27.912 [128038606003000] ERROR - [Req#2c7/Transcode] [FFMPEG] - No VA display found for device /dev/dri/renderD128.
Jul 08, 2025 22:57:27.912 [128038606003000] DEBUG - [Req#2c7/Transcode] Codecs: hardware transcoding: opening hw device failed - probably not supported by this system, error: Invalid argument
Jul 08, 2025 22:57:27.912 [128038606003000] DEBUG - [Req#2c7/Transcode] Could not create hardware context for h264_vaapi
Jul 08, 2025 22:57:27.912 [128038606003000] DEBUG - [Req#2c7/Transcode] Codecs: testing hevc (decoder) with hwdevice vaapi
Jul 08, 2025 22:57:27.912 [128038606003000] DEBUG - [Req#2c7/Transcode] Codecs: hardware transcoding: testing API vaapi for device '/dev/dri/renderD128' (Intel Alder Lake-UP3 GT2 [UHD Graphics])
Jul 08, 2025 22:57:27.912 [128038606003000] ERROR - [Req#2c7/Transcode] [FFMPEG] - No VA display found for device /dev/dri/renderD128.
Jul 08, 2025 22:57:27.912 [128038606003000] DEBUG - [Req#2c7/Transcode] Codecs: hardware transcoding: opening hw device failed - probably not supported by this system, error: Invalid argument
Jul 08, 2025 22:57:27.912 [128038606003000] DEBUG - [Req#2c7/Transcode] Could not create hardware context for hevc

The gpu appears owned by "104" within the docker container rather than the render group

I installed hwinfo inside the docker container to troubleshoot and it is able to see the gpu

GPU passthrough to the LXC is working and ffmpeg is able to use it to decode video successfully

Expected Behavior

The GPU should be used for transcoding

Steps To Reproduce

1. In a debian 12 LXC on proxmox with GPU passthrough working
2. Run the linuxserver plex image
3. Enable hardware decoding
4. Stream a video with transcoding
5. Observe that the GPU is not used, see the error in the plex server log

Environment

- OS: Debian 12
- How docker service was installed: distro's packagemanager

CPU architecture

x86-64

Docker creation

plex-server:
    container_name: plex-server
    image: lscr.io/linuxserver/plex:latest
    restart: unless-stopped
    environment:
      - TZ=${TZ} # timezone, defined in .env
      - VERSION=docker
    devices:
      - /dev/dri:/dev/dri
      - /dev/dri/renderD128:/dev/dri/renderD128
    network_mode: host
    volumes:
      - ${CONFIG}/plex/db:/config:Z # plex database
      - ${CONFIG}/plex/transcode:/transcode:Z # temp transcoded files
      - /mnt/Storage/Media:/data:ro,z # media library

Container logs

[migrations] started
[migrations] no migrations found
usermod: no changes
───────────────────────────────────────

      ██╗     ███████╗██╗ ██████╗
      ██║     ██╔════╝██║██╔═══██╗
      ██║     ███████╗██║██║   ██║
      ██║     ╚════██║██║██║   ██║
      ███████╗███████║██║╚██████╔╝
      ╚══════╝╚══════╝╚═╝ ╚═════╝

   Brought to you by linuxserver.io
───────────────────────────────────────

To support LSIO projects visit:
https://www.linuxserver.io/donate/

───────────────────────────────────────
GID/UID
───────────────────────────────────────

User UID:    911
User GID:    911
───────────────────────────────────────
Linuxserver.io version: 1.41.8.9834-071366d65-ls270
Build-date: 2025-06-30T09:31:12+00:00
───────────────────────────────────────
    
Change in ownership detected, please be patient while we chown existing files
This could take some time
Setting permissions on /transcode
**** Server already claimed ****
Docker is used for versioning skip update check
[custom-init] No custom files found, skipping...
Starting Plex Media Server. . . (you can ignore the libusb_init error)
Connection to localhost (::1) 32400 port [tcp/*] succeeded!
[ls.io-init] done.
Critical: libusb_init failed
Dolby, Dolby Digital, Dolby Digital Plus, Dolby TrueHD and the double D symbol are trademarks of Dolby Laboratories.

[github-actions]

Thanks for opening your first issue here! Be sure to follow the relevant issue templates, or risk having this issue marked as invalid.

[m-m-adams]

Oh forgot to add that changing the permissions on renderD128 to 666 in the lxc host does allow the plex docker image to use it for transcoding

[aptalca]

1. Map only /dev/dri, not the render device
2. We don't support lxc and we (and the proxmox devs) recommend against it for docker
3. Try this docker exec plex-server find /dev/dri -type c -print and post the output

[m-m-adams]

I'm aware that it's not supported however it should work anyway, other applications in this lxc and other docker containers are able to use the device correctly

That command gives no output but docker exec plex-server find /dev/dri -exec test -c {} \; -print does:

It appears to be hitting a bug in find where it incorrectly reports the type of bind mounted devices -debian findutils and gnu

Looking through the scripts I guess the change would be here

If that's the right spot I'll try building locally and testing again after work

[aptalca]

I'm aware that it's not supported however it should work anyway, other applications in this lxc and other docker containers are able to use the device correctly

You're not the first to report this and every single other report has been in lxc. In our experience, the code works on everything we (and our users) tested except for lxc, which is something we don't support or recommend, for this reason and many others.

I didn't read the bug reports you linked thoroughly as I honestly don't have the time or the motivation to sink into this, but I noticed they were both from 2018-2019. I would think whatever that issue was would be fixed by now.

[aptalca]

With that said, you can add this env var to take advantage of a new feature that rolled out to our baseimages. Whatever value you set gets put into the find line as arguments
https://github.com/linuxserver/docker-jellyfin/blob/nightly/Dockerfile#L17

[m-m-adams]

They're both still open and the test case reproduces on debian 12 (both vm and lxc) along with proxmox and ubuntu. There's discussion on the gnu savannah page about not fixing it as technically the kernel d_ino is non posix. Most of the coreutils have a workaround discussed on that page but it requires an extra stat() call and find has not done the same (which seems extremely picky). I'd guess the reason you get bug reports from lxc is just because that's where you encounter bind mounts and not due to an issue specific to lxc.

I don't see an env var like that on the plex repo yet but I can confirm that this patch works:

diff --git a/root/etc/s6-overlay/s6-rc.d/init-plex-gid-video/run b/root/etc/s6-overlay/s6-rc.d/init-plex-gid-video/run
index 083570f..80a65b8 100755
--- a/root/etc/s6-overlay/s6-rc.d/init-plex-gid-video/run
+++ b/root/etc/s6-overlay/s6-rc.d/init-plex-gid-video/run
@@ -2,7 +2,7 @@
 # shellcheck shell=bash
 
 if [[ -z ${LSIO_NON_ROOT_USER} ]]; then
-    FILES=$(find /dev/dri /dev/dvb -type c -print 2>/dev/null)
+    FILES=$(find /dev/dri /dev/dvb -exec test -c {} \; -print 2>/dev/null)
 
     for i in ${FILES}; do
         VIDEO_GID=$(stat -c '%g' "${i}")

If you'd like I can open a PR with some additional comments describing the reasoning for using exec test -c {} \; over -type c. Outside of avoiding the bug around find and bind mounted character devices they behave the same

Similarly I think the default in the jellyfin env var should be /dev/dri /dev/dvb /dev/vchiq /dev/vc-mem /dev/video1? exec test -c {} \; for the same reason