Privilegied LXC - /dev/dri/renderD128 in a strange group.

[cryonie]

Hello,

I made a privilegied LXC for jellyfin.
I'm "sharing" my iGPU with this LXC and everything is working fine except that /dev/dri/renderD128 is owned by root:kvm in my LXC instead of root:render.

If i look at proxmox is see this :
crw-rw---- 1 root video 226, 0 Oct 28 00:35 card0 crw-rw---- 1 root render 226, 128 Oct 28 00:35 renderD128
an in /etc/group
render:x:104:

and in the LXC :
crw-rw---- 1 root video 226, 0 28 oct. 00:35 card0 crw-rw---- 1 root kvm 226, 128 28 oct. 00:35 renderD128
and in /etc/group
render:x:105:jellyfin

Sooo ... is it normal that LXC has different group number that host ?
If i chown root:render in the LXC, it changes the proxmox owner to root:_ssh ... and that's not normal

The LXC config file is like this :
lxc.cgroup2.devices.allow: c 226:0 rwm lxc.cgroup2.devices.allow: c 226:128 rwm lxc.mount.entry: /dev/dri/card0 dev/dri/card0 none bind,optional,create=file lxc.mount.entry: /dev/dri/renderD128 dev/dri/renderD128 none bind,optional,create=file

In my understanding, on privilegied LXC groups should have been the same in the LXC and in the host (proxmox) but maybe i'm wrong.
Should i make IDMAP ? (but I thought to understand that idmap was only needed for unprivilegied LXC ... maybe i'm wrong).

Thanks for your help

PS :
/dev/dri/card0 is linked to video in proxmox and in lxc.
group video is 44 in proxmox and in the LXC (what i thought would happen to group render ... and all other groups)

 

[leesteken]

Sooo ... is it normal that LXC has different group number that host ?

Yes, since you can run just about any GNU/Linux distribution. You'll need to map the right container group to the host group: https://pve.proxmox.com/wiki/Unprivileged_LXC_containers