LXC container unprivileged GPU passthrough VA-API FFmpeg

[Sleeper]

Hi,

First I made this config in a privileged container without having any problems.

For security reasons I redid the same config in an unprivileged container.

For the GPU passthrough I was inspired by this article: https://bookstack.swigg.net/books/linux/page/lxc-gpu-access

The Nesting option is activated.

Here are the options that I added in the config of my LXC:

LXC privileged

lxc.cgroup.devices.allow: c 226:* rwm
lxc.mount.entry: /dev/dri dev/dri none bind,optional,create=dir

LXC unprivileged

lxc.cgroup.devices.allow: c 226:* rwm
lxc.mount.entry: /dev/dri dev/dri none bind,optional,create=dir
lxc.idmap: u 0 100000 65536
lxc.idmap: g 0 100000 44
lxc.idmap: g 44 44 1
lxc.idmap: g 45 100045 60
lxc.idmap: g 105 115 1
lxc.idmap: g 115 100108 65428

So I am using a Shinobi camera server which uses FFmpeg, so the FFmpeg commands below are executed through Shinobi.

Stream decoding using VAAPI works :

ffmpeg -progress pipe:5 -analyzeduration 1000000000 -probesize 1000000000 -stream_loop -1 -fflags +igndts -hwaccel vaapi -loglevel warning -re -i "https://cdn.shinobi.video:443/videos/bears.mp4" -strict -2 -c:a copy -c:v copy -preset ultrafast -f hls -hls_time 2 -hls_list_size 3 -start_number 0 -hls_allow_cache 0 -hls_flags +delete_segments+omit_endlist "/dev/shm/streams/JKdCv2UYdE/Camera_0/s.m3u8"

Stream decoding using VAAPI and object detection doens't works :

( but works in a privileged lxc container )

ffmpeg -progress pipe:5 -analyzeduration 1000000000 -probesize 1000000000 -stream_loop -1 -fflags +igndts -hwaccel vaapi -loglevel warning -re -i "https://cdn.shinobi.video:443/videos/bears.mp4" -strict -2 -c:a copy -c:v copy -preset ultrafast -f hls -hls_time 2 -hls_list_size 3 -start_number 0 -hls_allow_cache 0 -hls_flags +delete_segments+omit_endlist "/dev/shm/streams/JKdCv2UYdE/Camera_0/s.m3u8" -s 640x480 -vf "fps=1" -an -f singlejpeg pipe:4

Unfortunately I don't have any clear error messages to help debugging (I also asked for help on the Shinobi forum to get more info on this error).

Stream WITHOUT decoding using VAAPI and object detection works :

ffmpeg -progress pipe:5 -analyzeduration 1000000000 -probesize 1000000000 -stream_loop -1 -fflags +igndts -loglevel warning -re -i "https://cdn.shinobi.video:443/videos/bears.mp4" -strict -2 -c:a copy -c:v copy -preset ultrafast -f hls -hls_time 2 -hls_list_size 3 -start_number 0 -hls_allow_cache 0 -hls_flags +delete_segments+omit_endlist "/dev/shm/streams/JKdCv2UYdE/Camera_0/s.m3u8" -s 640x480 -vf "fps=1" -an -f singlejpeg pipe:4

So to summarize:

No HW dec + Object Detection = OK
VAAPI without Object Detection = OK
VAAPI + Object Detection = NOK

I suppose that there are still some rights or other missing for this unprivileged container to work properly ?

Do you have an idea ?

Thanks

 

[Sleeper]

Small up, any idea ?