I’ve tried on and UNprivileged container and it does not work :-(. On a Priviliged one works as charm …

Erp, slight error. The gid owning /dev/dri/renderD128 on my system is actually 103 (the “render” group on my host) and that’s the gid I mapped in my example. Not 128. Just pretend I wrote “103” everywhere I wrote “128”. Sorry for the confusion.

Here’s a quick screenshot to show that it does work, though. 🙂

https://share.icloud.com/photos/04dB23TqfkJxbacHStjOl9cAQ

You do not need the card0 device or the post-hook script unless you feel you really need the vainfo or intel_gpu_top tools available from within the container itself. They aren’t needed for ffmpeg within the container to access the GPU, transcoding to work, or for the software and GPU to just do their thing. Troubleshooting tools within the container are useful, but not necessary.

Assuming you have installed the appropriate packages on the host, as detailed here, the driver package within the container, and the gid for the device on your host is the same as the example (gid 128), this will work in an unprivileged container’s config file:

unprivileged: 1
lxc.cgroup2.devices.allow: c 226:128 rwm
lxc.mount.entry: /dev/dri/renderD128 dev/dri/renderD128 none bind,optional,create=file 0 0
lxc.idmap: g 0 100000 106
lxc.idmap: g 106 103 1
lxc.idmap: g 107 100107 1893

Note that I don’t bother mapping uid 226, because gid 128 has the same rw access to the device as uid 226, so why bother?

I also have the nesting and fuse options enabled that I need for other things, and I don’t think they are needed for transcoding, but mentioning theme here just in case.

In Proxmox, configure the container with the following extra lines:
# nano /etc/pve/lxc/100.conf
lxc.cgroup2.devices.allow: c 226:0 rwm
lxc.cgroup2.devices.allow: c 226:128 rwm
lxc.autodev: 1

When you log in to the container as root, create a new file:
# nano mount_hook.sh
mkdir -p /dev/dri
mknod -m 666 /dev/dri/card0 c 226 0
mknod -m 666 /dev/dri/renderD128 c 226 128

# chmod +x mount_hook.sh

crontab -e
(select 1 for nano editor)
Add this line:
@reboot /root/mount_hook.sh

After that, do:
# apt-get update
# apt-get install -y intel-media-va-driver # or whatever driver you need
# apt-get install -y vainfo intel-gpu-tools # tools to verify/debug installation
# reboot

At this point I was able to go:
# vainfo
error: can’t connect to X server!
libva info: VA-API version 1.10.0
libva info: Trying to open /usr/lib/x86_64-linux-gnu/dri/iHD_drv_video.so
libva info: Found init function __vaDriverInit_1_10
libva info: va_openDriver() returns 0
vainfo: VA-API version: 1.10 (libva 2.10.0)
vainfo: Driver version: Intel iHD driver for Intel(R) Gen Graphics – 21.1.1 ()
vainfo: Supported profile and entrypoints
VAProfileMPEG2Simple : VAEntrypointVLD
VAProfileMPEG2Main : VAEntrypointVLD
VAProfileH264Main : VAEntrypointVLD
VAProfileH264Main : VAEntrypointEncSliceLP
VAProfileH264High : VAEntrypointVLD
VAProfileH264High : VAEntrypointEncSliceLP
VAProfileJPEGBaseline : VAEntrypointVLD
VAProfileJPEGBaseline : VAEntrypointEncPicture
VAProfileH264ConstrainedBaseline: VAEntrypointVLD
VAProfileH264ConstrainedBaseline: VAEntrypointEncSliceLP
VAProfileVP8Version0_3 : VAEntrypointVLD
VAProfileHEVCMain : VAEntrypointVLD
VAProfileHEVCMain10 : VAEntrypointVLD
VAProfileVP9Profile0 : VAEntrypointVLD
VAProfileVP9Profile2 : VAEntrypointVLD

Finally works!

Specifically, I think there is no such variable: ${LXC_ROOTFS_MOUNT}

So I changed “/var/lib/lxc/100/mount_hook.sh” to this:
mkdir -p /ZFS/subvol-100-disk-0/dev/dri
mknod -m 666 /ZFS/subvol-100-disk-0/dev/dri/card0 c 226 0
mknod -m 666 /ZFS/subvol-100-disk-0/dev/dri/renderD128 c 226 128

Proxmox still won’t start up the container, and it gives the same error message “Failed to run autodev hooks”.

So I disabled that hook altogether:
# nano /etc/pve/lxc/100.conf
lxc.cgroup2.devices.allow: c 226:0 rwm
lxc.cgroup2.devices.allow: c 226:128 rwm
lxc.autodev: 1
#lxc.hook.autodev: /var/lib/lxc/100/mount_hook.sh

NOW the container can boot, but if I go
# ls -lh /dev/dri
ls: cannot access ‘/dev/dri’: No such file or directory

So, from the shell in my Linux container:
#mkdir -p /dev/dri
#mknod -m 666 /dev/dri/card0 c 226 0
#mknod -m 666 /dev/dri/renderD128 c 226 128

All of a sudden here we go:
# ls -lh /dev/dri
total 0
crw-rw-rw- 1 root root 226, 0 Aug 23 20:58 card0
crw-rw-rw- 1 root root 226, 128 Aug 23 20:58 renderD128

# vainfo
error: can’t connect to X server!
libva info: VA-API version 1.15.0
libva info: Trying to open /usr/lib/x86_64-linux-gnu/dri/iHD_drv_video.so
libva info: Found init function __vaDriverInit_1_14
libva info: va_openDriver() returns 0
vainfo: VA-API version: 1.15 (libva 2.12.0)
vainfo: Driver version: Intel iHD driver for Intel(R) Gen Graphics – 22.4.3 ()
vainfo: Supported profile and entrypoints
VAProfileMPEG2Simple : VAEntrypointVLD
VAProfileMPEG2Main : VAEntrypointVLD
VAProfileH264Main : VAEntrypointVLD
VAProfileH264Main : VAEntrypointEncSliceLP
VAProfileH264High : VAEntrypointVLD
VAProfileH264High : VAEntrypointEncSliceLP
VAProfileJPEGBaseline : VAEntrypointVLD
VAProfileJPEGBaseline : VAEntrypointEncPicture
VAProfileH264ConstrainedBaseline: VAEntrypointVLD
VAProfileH264ConstrainedBaseline: VAEntrypointEncSliceLP
VAProfileVP8Version0_3 : VAEntrypointVLD
VAProfileHEVCMain : VAEntrypointVLD
VAProfileHEVCMain10 : VAEntrypointVLD
VAProfileVP9Profile0 : VAEntrypointVLD
VAProfileVP9Profile2 : VAEntrypointVLD

# lspci -v
00:02.0 VGA compatible controller: Intel Corporation Whiskey Lake-U GT1 [UHD Graphics 610] (rev 02) (prog-if 00 [VGA controller])
DeviceName: Onboard – Video
Subsystem: Intel Corporation Device 2212
Flags: bus master, fast devsel, latency 0, IRQ 126, IOMMU group 1
Memory at a0000000 (64-bit, non-prefetchable) [size=16M]
Memory at 90000000 (64-bit, prefetchable) [size=256M]
I/O ports at 3000 [size=64]
Expansion ROM at 000c0000 [virtual] [disabled] [size=128K]
Capabilities: [40] Vendor Specific Information: Len=0c
Capabilities: [70] Express Root Complex Integrated Endpoint, MSI 00
Capabilities: [ac] MSI: Enable+ Count=1/1 Maskable- 64bit-
Capabilities: [d0] Power Management version 2
Capabilities: [100] Process Address Space ID (PASID)
Capabilities: [200] Address Translation Service (ATS)
Capabilities: [300] Page Request Interface (PRI)
Kernel driver in use: i915

So there’s some issue with the way this “autodev hooks” is written, there’s a mystery surrounding this Proxmox container variable “${LXC_ROOTFS_MOUNT}” that doesn’t seem to work.

I wonder what the solution is?

# lspci -v
00:02.0 VGA compatible controller: Intel Corporation Device 3ea1 (rev 02) (prog-if 00 [VGA controller])
DeviceName: Onboard – Video
Subsystem: Intel Corporation Device 2212
Flags: bus master, fast devsel, latency 0, IRQ 126, IOMMU group 1
Memory at a0000000 (64-bit, non-prefetchable) [size=16M]
Memory at 90000000 (64-bit, prefetchable) [size=256M]
I/O ports at 3000 [size=64]
Expansion ROM at 000c0000 [virtual] [disabled] [size=128K]
Capabilities: [40] Vendor Specific Information: Len=0c
Capabilities: [70] Express Root Complex Integrated Endpoint, MSI 00
Capabilities: [ac] MSI: Enable+ Count=1/1 Maskable- 64bit-
Capabilities: [d0] Power Management version 2
Capabilities: [100] Process Address Space ID (PASID)
Capabilities: [200] Address Translation Service (ATS)
Capabilities: [300] Page Request Interface (PRI)
Kernel driver in use: i915
Kernel modules: i915

So, I tried this:
# echo “blacklist i915” >> /etc/modprobe.d/blacklist.conf
# update-initramfs -u -k all
# reboot

Funny thing, lspci -v gives the same “Kernel driver in use: i915” (despite being “blacklisted”) and same error with the Ubuntu 22.04 LXC.

run_buffer: 322 Script exited with status 1
lxc_setup: 4445 Failed to run autodev hooks
do_start: 1272 Failed to setup container “100”
sync_wait: 34 An error occurred in another process (expected sequence number 4)
__lxc_start: 2107 Failed to spawn container “100”
TASK ERROR: startup for container ‘100’ failed

I guess I’ll try again with “privileged” LXC? Anybody else getting anywhere?

run_buffer: 322 Script exited with status 1
lxc_setup: 4445 Failed to run autodev hooks
do_start: 1272 Failed to setup container “100”
sync_wait: 34 An error occurred in another process (expected sequence number 4)
__lxc_start: 2107 Failed to spawn container “100”
TASK ERROR: startup for container ‘100’ failed

Setup:
# cat /etc/pve/lxc/100.conf
arch: amd64
cores: 2
features: nesting=1
hostname: Datto
memory: 6144
nameserver: 1.1.1.1
net0: name=eth0,bridge=vmbr0,firewall=1,gw=192.168.1.254,hwaddr=62:FF:A2:38:8E:03,ip=192.168.1.30/24,type=veth
ostype: ubuntu
rootfs: ZFS:subvol-100-disk-0,size=150G
swap: 512
unprivileged: 1
lxc.cgroup2.devices.allow: c 226:0 rwm
lxc.cgroup2.devices.allow: c 226:128 rwm
lxc.autodev: 1
lxc.hook.autodev: /var/lib/lxc/100/mount_hook.sh

Same issue on an unprivileged container. Haven’t tried this with privileged.