using intel quick sync inside container?

[PeterAndersson]

Hi I have a machine with a Intel® Core™ i5-4690K CPU, that has Intel Quick Sync according to Arc
I have installed the i965-va-driver-shaders package and can see that something is detected by running vainfo

error: can't connect to X server!
libva info: VA-API version 1.10.0
libva info: Trying to open /usr/lib/x86_64-linux-gnu/dri/iHD_drv_video.so
libva info: va_openDriver() returns -1
libva info: Trying to open /usr/lib/x86_64-linux-gnu/dri/i965_drv_video.so
libva info: Found init function __vaDriverInit_1_8
libva info: va_openDriver() returns 0
vainfo: VA-API version: 1.10 (libva 2.10.0)
vainfo: Driver version: Intel i965 driver for Intel(R) Haswell Desktop - 2.4.1
vainfo: Supported profile and entrypoints
      VAProfileMPEG2Simple            : VAEntrypointVLD
      VAProfileMPEG2Simple            : VAEntrypointEncSlice
      VAProfileMPEG2Main              : VAEntrypointVLD
      VAProfileMPEG2Main              : VAEntrypointEncSlice
      VAProfileH264ConstrainedBaseline: VAEntrypointVLD
      VAProfileH264ConstrainedBaseline: VAEntrypointEncSlice
      VAProfileH264Main               : VAEntrypointVLD
      VAProfileH264Main               : VAEntrypointEncSlice
      VAProfileH264High               : VAEntrypointVLD
      VAProfileH264High               : VAEntrypointEncSlice
      VAProfileH264MultiviewHigh      : VAEntrypointVLD
      VAProfileH264MultiviewHigh      : VAEntrypointEncSlice
      VAProfileH264StereoHigh         : VAEntrypointVLD
      VAProfileH264StereoHigh         : VAEntrypointEncSlice
      VAProfileVC1Simple              : VAEntrypointVLD
      VAProfileVC1Main                : VAEntrypointVLD
      VAProfileVC1Advanced            : VAEntrypointVLD
      VAProfileNone                   : VAEntrypointVideoProc
      VAProfileJPEGBaseline           : VAEntrypointVLD

I created a new unprivileged container running debian 11 and added the following to the configuration

lxc.cgroup2.devices.allow: c 226:0 rwm
lxc.cgroup2.devices.allow: c 226:128 rwm
lxc.cgroup2.devices.allow: c 29:0 rwm
lxc.mount.entry: /dev/dri dev/dri none bind,optional,create=dir
lxc.mount.entry: /dev/dri/renderD128 dev/renderD128 none bind,optional,create=file

But when install emby inside the container it fails to detect intel quick sync.

If I check the logs it has the following message Failed to open the drm device /dev/dri/renderD128 what am I missing? is intel quick sync pass thru supported on unprivileged containers or does it require a privileged container?

I have checked and the /dev/dri exists inside the container so that part works as expected.

 

[PeterAndersson]

After mapping the video and render group into the container it seems to be detected

This was done by running the following commands getent group video | cut -d: -f3 and getent group render | cut -d: -f3 on the host and in the container and mapping them using the config file and /etc/subuid and /etc/subgid

 

[tianmo]

After mapping the video and render group into the container it seems to be detected

This was done by running the following commands getent group video | cut -d: -f3 and getent group render | cut -d: -f3 on the host and in the container and mapping them using the config file and /etc/subuid and /etc/subgid

hi,can you please tell me how to map it?
Thank you very much!