New LXC Add Option - Device Passthrough

[tteck]

Has anyone tried this to see if it works in an unprivileged container?

[tteck]

110.conf

  GNU nano 7.2                                          /etc/pve/lxc/110.conf                                                   
#<div align='center'><a href='https%3A//Helper-Scripts.com' target='_blank' rel='noopener noreferrer'><img src='https%3A//raw.g>
#
#  # Debian LXC
#
#  <a href='https%3A//ko-fi.com/D1D7EP4GF'><img src='https%3A//img.shields.io/badge/&#x2615;-Buy me a coffee-blue' /></a>
#  </div>
arch: amd64
cores: 1
dev0: /dev/dri/card0
dev1: /dev/dri/renderD128
features: keyctl=1,nesting=1
hostname: debian
memory: 512
net0: name=eth0,bridge=vmbr0,hwaddr=AE:1A:60:07:B7:59,ip=dhcp,type=veth
onboot: 1
ostype: debian
rootfs: thin-pool:vm-110-disk-0,size=2G
swap: 512
tags: proxmox-helper-scripts
unprivileged: 1

[tteck]

root@debian:~# ls -l /dev/dri
total 0
crw-rw---- 1 root root 226,   0 Apr 24 06:29 card0
crw-rw---- 1 root root 226, 128 Apr 24 06:29 renderD128
root@debian:~#

[rcv11x]

i noticed just yesterday when i updated proxmox, it would be great to run the iGPU in an unprivileged container because i currently use jellyfin with privileged LXC and it is dangerous, it would solve all my problems because running the iGPU in a VM is very complicated ;/

[tripodsgames]

Using advanced settings to set the GID to render(104).
Works perfectly in unprivileged containers.

[rcv11x]

100% verified, it works with jellyfin!!!
this is incredible because now being non-privileged there is no risk as before.

[tteck]

Currently works only with 10bit HDR10，HLG and DoVi videos. This requires the corresponding OpenCL or CUDA runtime.

👨🏻‍🦱 My focus is on developing application LXC scripts, and maintaining said scripts. I do not specialize in, nor do I have the time to provide support for operational issues.

[rcv11x]

@tteck Sorry, I have an off topic question, these intel dependencies are installed on the proxmox host or inside the LXC? I installed them in the LXC I guess it's ok right?

[tteck]

LXC

[qnlbnsl]

@tteck Would it matter if i am running on AMD? seeing as it is trying to install intel-gpu-tools? or are you just setting up a catch all?

[tteck]

Installing Intel-specific software does not affect AMD processors.

[alve89]

Has anyone tried this to see if it works in an unprivileged container?

Which PVE version are you using? I don't see this option:

[tteck]

8.2

[di5cord20]

I'm running a Docker LXC container and made it privilaged to allow for HW Acceleration (used by Immich). Any suggestions for converting to unprivilaged? I can simply do an LXC restore and modify to unprivilaged, but I noticed above that approach may necessate addition steps to fix groups/permissions.

[egonzalez7579]

back up lxc, then restore,
should give the option to change ot

[EcN000]

Crazy coincidence I stumbled on to a such a recent post regarding this. I created a plex server about a month or so using your script and spent a whole day trying to pass through quicksync for plex.

Today I decided to run your script for a clean slate and I noticed that hardware transcoding worked out the box! The biggest thing I noticed was the addition of:

dev0: /dev/dri/card0,gid=44
dev1: /dev/dri/renderD128,gid=104

So I tried adding that to my old unprivileged plex lxc, but it didn't work. I decided to just migrate to the new container. I also noticed my old lxc was debian, but not sure if that was chosen explicitly by me.

Did you make a change to the plex script recently?
Edit: Wow I just saw the changelog that you just added it. Perfect timing!!!!
FYI in your note you specified not tested <8.2.

Works for me on 8.1.11.

Thank you!

[tteck]

Change Log updated! Thanks

[EcN000]

Would you be able to apply similar changes you made with plex/jellyfin with frigate? A lot of frigate users have coral tpu via pci as well as use igpu for processing.

[tteck]

It's on the list to try. 😉

[tteck]

d22dd10

[towerhand]

How are you mounting a shared drive? I tried using the unprivileged container, but I don't have the correct permissions to access my NFS folder that is binded to mp0.

[alve89]

From my /etc/pve/lxc/xxx.conf file:
mp0: /mnt/nfs,mp=/mnt/nfs
where mp is the hosts (= PVE mount point) and mp0 is the LXCs mount point.
You need to add the mount point on the host first and then add this path to the LXC.

[towerhand]

That's what I do, but the folder is showing as nobody:nogroup. Therefore, I can see the folder is there, but I have no permission to access it from the LXC.

[alve89]

I can't reproduce this issue, so just a general idea: Can't you chown the folder inside the LXC to your user?

[bigrichwood]

User/Group IDs will be different when accessing from the the LXC compared to the host. I had to set my NFS share to squash the permissions to either admin or guest before I could access it in the LXC.

This is with a read-only share mounted from my Synology NAS.

[towerhand]

alve89 I changed the folder owner from root:root to my user and the users group.

bigrichwood My NFS share is mounted from a Synology NAS too. I'll try creating a user with the same UID and GID on the proxmox host to see if that works since I would prefer avoiding to squash the permissions.

[Koliera]

Might be silly question - where can I see the HDDs I've added to the passthrough?
I've added 3 HDDs via the passthrough option, but when in jellyfin I cannot seem to find them when setting the libraries.
/srv /mnt /media all seem to be empty

[danluckner]

For some reason, the groups in the Jellyfin LXC created from the script has the render as 993, and _ssh on 104.
But on host, all seems good.

In the Jellyfix LXC container (Ubuntu 24.04) unprivileged, cat /etc/group :

root:x:0:
daemon:x:1:
bin:x:2:
sys:x:3:
adm:x:4:syslog
tty:x:5:
disk:x:6:
lp:x:7:
mail:x:8:
news:x:9:
uucp:x:10:
man:x:12:
proxy:x:13:
kmem:x:15:
dialout:x:20:
fax:x:21:
voice:x:22:
cdrom:x:24:
floppy:x:25:
tape:x:26:
sudo:x:27:
audio:x:29:
dip:x:30:
www-data:x:33:
backup:x:34:
operator:x:37:
list:x:38:
irc:x:39:
src:x:40:
shadow:x:42:
utmp:x:43:
video:x:44:jellyfin
sasl:x:45:
plugdev:x:46:
staff:x:50:
games:x:60:
users:x:100:
nogroup:x:65534:
systemd-journal:x:999:
systemd-network:x:998:
systemd-timesync:x:997:
input:x:996:
sgx:x:995:
kvm:x:994:
render:x:993:jellyfin
messagebus:x:101:
syslog:x:102:
ssl-cert:x:103:
systemd-resolve:x:992:
_ssh:x:104:
postfix:x:105:
postdrop:x:106:
uuidd:x:107:
crontab:x:991:
rdma:x:108:
tcpdump:x:109:
jellyfin:x:110:

[tteck]

This is because the script is set up to use Ubuntu 22.04. Groups haven't been corrected for Ubuntu 24.04.

Ubuntu 22.02:

Proxmox/install/jellyfin-install.sh

Lines 57 to 61 in 07895a7

	if [[ "$CTTYPE" == "0" ]]; then
	sed -i -e 's/^ssl-cert:x:104:$/render:x:104:root,jellyfin/' -e 's/^render:x:108:root,jellyfin$/ssl-cert:x:108:/' /etc/group
	else
	sed -i -e 's/^ssl-cert:x:104:$/render:x:104:jellyfin/' -e 's/^render:x:108:jellyfin$/ssl-cert:x:108:/' /etc/group
	fi

You can try executing the following sed command to correct the groups in a unprivileged container using Ubuntu 24.04

sed -i -e 's/^_ssh:x:104:$/render:x:104:jellyfin/' -e 's/^render:x:993:jellyfin$/_ssh:x:993:/' /etc/group

[danluckner]

That corrected it.
I changed the Resourse back to gid=104 and it is working as intended.

Thanks!

[millercentral]

This is because the script is set up to use Ubuntu 22.04. Groups haven't been corrected for Ubuntu 24.04.

Ubuntu 22.02:

Proxmox/install/jellyfin-install.sh

Lines 57 to 61 in 07895a7

	if [[ "$CTTYPE" == "0" ]]; then
	sed -i -e 's/^ssl-cert:x:104:$/render:x:104:root,jellyfin/' -e 's/^render:x:108:root,jellyfin$/ssl-cert:x:108:/' /etc/group
	else
	sed -i -e 's/^ssl-cert:x:104:$/render:x:104:jellyfin/' -e 's/^render:x:108:jellyfin$/ssl-cert:x:108:/' /etc/group
	fi

You can try executing the following sed command to correct the groups in a unprivileged container using Ubuntu 24.04

sed -i -e 's/^_ssh:x:104:$/render:x:104:jellyfin/' -e 's/^render:x:993:jellyfin$/_ssh:x:993:/' /etc/group

Would this be a better approach for identifying the container group id at LXC setup time?

ctid=100 # for example
renderid=$(pct exec $ctid getent group render | cut -d: -f3)
pct set $ctid -dev0 /dev/dri/renderD128,gid=$renderid

[tteck]

The LXC render group needs to match the Proxmox host render group

[millercentral]

The LXC render group needs to match the Proxmox host render group

I thought the ",gid=" option in the dev0: mount was to enable you to remap the device to the LXC group id (in this case the lxc render group)?

[Mhp31]

I installed jellyfin unprivileged, and no hw transcoding. The script has render as 104, but 'id jellyfin' showed gid=106 for render. Changed it to 106 and now hw transcoding is working!

[PropaneMilo]

See edit

I'm running an unprivileged Plex LXC on Proxmox 8.2.7.
I can't get /dev/dri/card0 or /dev/dri/renderD128 to do the passthrough thing.

My problem seems to be reflected in two places.

ls -l /dev/dri on the LCX shows ownership and group of nobody and nogroup.

When I add card0 and renderD128 via Add > Device Passthrough the LXC will not boot.

I've looked at all sorts of troubleshooting and advice and none of it has worked. I am going mad trying to fix this.
(I know this is a Jellyfin thread but a lot of the concepts seem very aligned.)

Edit: Alright, oops.

I am fresh to linux and I dug myself into a hole. tteck posting the 101.conf contents pointed me to the solution.

In all my efforts to get Intel QuickSync working, I followed some advice that led me astray, and then I forgot about it. Because I migrated my Plex data from an old Synology server, lots of things were a mess.
I had the following lines in /etc/pve/lxc/<###>.conf file. Removing these lines and rebooting the Plex LXC solved my problem.

lxc.cgroup2.devices.allow: c 226:1 rwm
lxc.cgroup2.devices.allow: c 226:128 rwm
lxc.cgroup2.devices.allow: c 29:0 rwm
lxc.mount.entry: /dev/dri dev/dri none bind,optional,create=dir
lxc.mount.entry: /dev/dri/renderD128 dev/renderD128 none bind,optional,create=file

If a future googler finds this; if you've been throwing potential solutions at passthrough transcoding, especially if you imported an older Plex instance, clean up your host's /etc/pve/lxc/<###>.conf file. A lot of advice for this has you mucking about in there.