[TUTORIAL] Intel Coffeelake Plex hardware transcoding in Debian unprivileged LXC container


New Member
Aug 10, 2023
Just in case anyone needs help getting Intel Coffeelake Plex hardware transcoding in a unprivileged Debian 12 LXC, here are my steps. I struggled a bit following various tutorials because my gid mapping was different, and most also map uid when only gid is needed.

On the Proxmox VE host, I have a /dev/dri that looks like:

root@pve:~# ls -l /dev/dri
total 0
drwxr-xr-x 2 root root         80 Aug 21 14:07 by-path
crw-rw---- 1 root video  226,   0 Aug 21 14:07 card0
crw-rw---- 1 root render 226, 128 Aug 21 14:07 renderD128

And lspci shows I have an Intel Coffeelake:

root@pve:~# lspci | grep VGA
00:02.0 VGA compatible controller: Intel Corporation CoffeeLake-S GT2 [UHD Graphics 630]

The renderD128 device is all that is needed by Plex. It is owned by group render on the host, and this is group ID 104:

root@pve:~# grep render /etc/group

Now I setup a unprivileged Debian 12 LXC container with Plex. We need to push the render group from the host to the container. However, in my container, the render group does not have ID 104, but instead 106:

root@container:~# grep render /etc/group                                                                                                                                                                                                                  

So we need to map group ID 104 on the host to group ID 106 in the container. First let's add plex to the render group in the container. The plex user is added when installing Plex via the package. In the container:

root@container:~# groupmod -a -U plex render
root@container:~# grep render /etc/group

Next, add to these lines to the container config on the host:

root@pve:/etc/pve/lxc# tail -6 101.conf
lxc.cgroup.devices.allow: c 226:* rwm
lxc.mount.entry: /dev/dri dev/dri none bind,optional,create=dir
lxc.idmap: u 0 100000 65536
lxc.idmap: g 0 100000 106
lxc.idmap: g 106 104 1
lxc.idmap: g 107 100107 65429

The u is still added here but we aren't doing any different mapping. It seems to be required. The 65429 number comes from (65535-107+1). Next, add a line to /etc/subgid on the host:

root@pve:/etc/pve/lxc# tail -1 /etc/subgid

Reboot the container, and Plex hardware transcoding should work (how to check). If it doesn't work, you can look for errors in /var/lib/plexmediaserver/Library/Application Support/Plex Media Server/Logs/Plex Media Server.log. Good luck!
  • Like
Reactions: Lukas Wagner


The Proxmox community has been around for many years and offers help and support for Proxmox VE, Proxmox Backup Server, and Proxmox Mail Gateway.
We think our community is one of the best thanks to people like you!

Get your subscription!

The Proxmox team works very hard to make sure you are running the best software and getting stable updates and security enhancements, as well as quick enterprise support. Tens of thousands of happy customers have a Proxmox subscription. Get yours easily in our online shop.

Buy now!