SVI/ProxmoxVE
1
0
Fork 0
mirror of https://github.com/community-scripts/ProxmoxVE.git synced 2026-03-31 06:34:17 -04:00
Code Issues 2.6k Packages Projects Releases 10 Wiki Activity

Jellyfin unprivileged LXC hardware acceleration possibly assigning wrong group ownership to the render device? #1954

New Issue
Closed
opened 2025-11-20 05:20:35 -05:00 by saavagebueno · 6 comments
saavagebueno commented 2025-11-20 05:20:35 -05:00
Owner
Copy Link

Originally created by @nalabrie on GitHub (Sep 25, 2025).

✅ Have you read and understood the above guidelines?

yes

📜 What is the name of the script you are using?

Jellyfin Media Server

📂 What was the exact command used to execute the script?

bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/ct/jellyfin.sh)"

⚙️ What settings are you using?

  • Default Settings
  • Advanced Settings

🖥️ Which Linux distribution are you using?

Ubuntu 24.04

📈 Which Proxmox version are you on?

pve-manager/9.0.10/deb1ca707ec72a89 (running kernel: 6.14.11-2-pve)

📝 Provide a clear and concise description of the issue.

I'm running proxmox on a host with an Intel i7-9700T. I installed the Jellyfin LXC in unprivileged mode. Only "advanced" setting I changed was core count and disk size. I answered "yes" to hardware acceleration during script setup. I enabled hardware acceleration in the Jellyfin admin panel (using Intel QSV). Forcing a video to transcode to a lower quality crashes with a fatal error. The log ends with the following output from ffmpeg:

Device creation failed: -542398533.
Failed to set value 'vaapi=va:,vendor_id=0x8086,driver=iHD' for option 'init_hw_device': Generic error in an external library
Error parsing global options: Generic error in an external library

Some Googling shows similar (but not identical) errors. Here is one example. I checked and the renderD128 device by default has the group ownership set to _ssh. I did the following (inside the LXC):

root@jellyfin:~# cd /dev/dri
root@jellyfin:/dev/dri# ll
total 0
drwxr-xr-x 2 root root        80 Sep 24 20:26 ./
drwxr-xr-x 7 root root       500 Sep 24 20:26 ../
crw-rw---- 1 root video 226,   0 Sep 24 20:26 card0
crw-rw---- 1 root _ssh  226, 128 Sep 24 20:26 renderD128
root@jellyfin:/dev/dri# chown :render renderD128
root@jellyfin:/dev/dri# ll
total 0
drwxr-xr-x 2 root root         80 Sep 24 20:26 ./
drwxr-xr-x 7 root root        500 Sep 24 20:26 ../
crw-rw---- 1 root video  226,   0 Sep 24 20:26 card0
crw-rw---- 1 root render 226, 128 Sep 24 20:26 renderD128

Problem is solved entirely.

🔄 Steps to reproduce the issue.

  1. Install Jellyfin LXC from helper script (unprivileged mode)
  2. Allow it to enable hardware acceleration
  3. Go to Jellyfin admin page in browser
  4. Go to dashboard > playback > transcoding to enable hardware acceleration (in my case, Intel QSV)
  5. Play a video file and use the settings cog to set it to a lower bitrate which forces transcoding to occur
  6. Get a fatal error, video crashes

❌ Paste the full error output (if available).

N/A

🖼️ Additional context (optional).

No response

Originally created by @nalabrie on GitHub (Sep 25, 2025). ### ✅ Have you read and understood the above guidelines? yes ### 📜 What is the name of the script you are using? Jellyfin Media Server ### 📂 What was the exact command used to execute the script? bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/ct/jellyfin.sh)" ### ⚙️ What settings are you using? - [ ] Default Settings - [x] Advanced Settings ### 🖥️ Which Linux distribution are you using? Ubuntu 24.04 ### 📈 Which Proxmox version are you on? pve-manager/9.0.10/deb1ca707ec72a89 (running kernel: 6.14.11-2-pve) ### 📝 Provide a clear and concise description of the issue. I'm running proxmox on a host with an Intel i7-9700T. I installed the Jellyfin LXC in unprivileged mode. Only "advanced" setting I changed was core count and disk size. I answered "yes" to hardware acceleration during script setup. I enabled hardware acceleration in the Jellyfin admin panel (using Intel QSV). Forcing a video to transcode to a lower quality crashes with a fatal error. The log ends with the following output from ffmpeg: ``` Device creation failed: -542398533. Failed to set value 'vaapi=va:,vendor_id=0x8086,driver=iHD' for option 'init_hw_device': Generic error in an external library Error parsing global options: Generic error in an external library ``` Some Googling shows similar (but not identical) errors. [Here](https://github.com/tteck/Proxmox/issues/3489#issuecomment-2286259711) is one example. I checked and the `renderD128` device by default has the group ownership set to `_ssh`. I did the following (inside the LXC): ```console root@jellyfin:~# cd /dev/dri root@jellyfin:/dev/dri# ll total 0 drwxr-xr-x 2 root root 80 Sep 24 20:26 ./ drwxr-xr-x 7 root root 500 Sep 24 20:26 ../ crw-rw---- 1 root video 226, 0 Sep 24 20:26 card0 crw-rw---- 1 root _ssh 226, 128 Sep 24 20:26 renderD128 root@jellyfin:/dev/dri# chown :render renderD128 root@jellyfin:/dev/dri# ll total 0 drwxr-xr-x 2 root root 80 Sep 24 20:26 ./ drwxr-xr-x 7 root root 500 Sep 24 20:26 ../ crw-rw---- 1 root video 226, 0 Sep 24 20:26 card0 crw-rw---- 1 root render 226, 128 Sep 24 20:26 renderD128 ``` Problem is solved entirely. ### 🔄 Steps to reproduce the issue. 1. Install Jellyfin LXC from helper script (unprivileged mode) 2. Allow it to enable hardware acceleration 3. Go to Jellyfin admin page in browser 4. Go to `dashboard > playback > transcoding` to enable hardware acceleration (in my case, Intel QSV) 5. Play a video file and use the settings cog to set it to a lower bitrate which forces transcoding to occur 6. Get a fatal error, video crashes ### ❌ Paste the full error output (if available). N/A ### 🖼️ Additional context (optional). _No response_
saavagebueno added the bug label 2025-11-20 05:20:35 -05:00
saavagebueno commented 2025-11-20 05:20:36 -05:00
Author
Owner
Copy Link

@github-actions[bot] commented on GitHub (Sep 25, 2025):

Hello, it looks like you are referencing the old tteck repo.

This repository is no longer used for active scripts.
Please update your bookmarks and use: https://helper-scripts.com

Also make sure your Bash command starts with:

bash <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/ct/...)

This issue is being closed automatically.

@github-actions[bot] commented on GitHub (Sep 25, 2025): Hello, it looks like you are referencing the **old tteck repo**. This repository is no longer used for active scripts. **Please update your bookmarks** and use: [https://helper-scripts.com](https://helper-scripts.com) Also make sure your Bash command starts with: ```bash bash <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/ct/...) ``` This issue is being closed automatically.
saavagebueno commented 2025-11-20 05:20:36 -05:00
Author
Owner
Copy Link

@nalabrie commented on GitHub (Sep 25, 2025):

This issue is being closed automatically.

Hey ya clanker, please re-open the issue. All I did was reference a similar problem that I also found Google results for outside of the context of proxmox and the helper scripts.

@nalabrie commented on GitHub (Sep 25, 2025): > This issue is being closed automatically. Hey ya clanker, please re-open the issue. All I did was reference a similar problem that I also found Google results for outside of the context of proxmox and the helper scripts.
saavagebueno commented 2025-11-20 05:20:36 -05:00
Author
Owner
Copy Link

@nalabrie commented on GitHub (Sep 29, 2025):

Might also be worth mentioning that on each reboot the group ownership is changed back to _ssh. A simple systemd service like this works:

[Unit]
Description=Fix permissions on /dev/dri/renderD128
After=systemd-udevd.service
Before=multi-user.target

[Service]
Type=oneshot
ExecStart=/usr/bin/chown :render /dev/dri/renderD128
RemainAfterExit=yes

[Install]
WantedBy=multi-user.target
@nalabrie commented on GitHub (Sep 29, 2025): Might also be worth mentioning that on each reboot the group ownership is changed back to `_ssh`. A simple systemd service like this works: ``` [Unit] Description=Fix permissions on /dev/dri/renderD128 After=systemd-udevd.service Before=multi-user.target [Service] Type=oneshot ExecStart=/usr/bin/chown :render /dev/dri/renderD128 RemainAfterExit=yes [Install] WantedBy=multi-user.target ```
saavagebueno commented 2025-11-20 05:20:36 -05:00
Author
Owner
Copy Link

@DoshiHarsh commented on GitHub (Oct 10, 2025):

Confirming that same is happening with me in a privileged container. Though in my case the group is being changed to kvm. Any change made to the group ownership from inside the LXC, breaks it for other LXC's (eg Jellfyfin). Are there any workarounds?

root@immich:~# ls -la /dev/dri
total 0
drwxr-xr-x 3 root root       100 Oct  5 10:03 .
drwxr-xr-x 9 root root       640 Oct  5 10:10 ..
drwxr-xr-x 2 root root        80 Oct  5 10:03 by-path
crw-rw---- 1 root video 226,   0 Oct  5 10:03 card0
crw-rw---- 1 root kvm   226, 128 Oct  5 10:03 renderD128
@DoshiHarsh commented on GitHub (Oct 10, 2025): Confirming that same is happening with me in a privileged container. Though in my case the group is being changed to `kvm`. Any change made to the group ownership from inside the LXC, breaks it for other LXC's (eg Jellfyfin). Are there any workarounds? ``` root@immich:~# ls -la /dev/dri total 0 drwxr-xr-x 3 root root 100 Oct 5 10:03 . drwxr-xr-x 9 root root 640 Oct 5 10:10 .. drwxr-xr-x 2 root root 80 Oct 5 10:03 by-path crw-rw---- 1 root video 226, 0 Oct 5 10:03 card0 crw-rw---- 1 root kvm 226, 128 Oct 5 10:03 renderD128 ```
saavagebueno commented 2025-11-20 05:20:37 -05:00
Author
Owner
Copy Link

@VEEC023 commented on GitHub (Oct 24, 2025):

I have the same problem.

@VEEC023 commented on GitHub (Oct 24, 2025): I have the same problem.
saavagebueno commented 2025-11-20 05:20:37 -05:00
Author
Owner
Copy Link

@frysztak commented on GitHub (Oct 24, 2025):

inside the container, you can change _ssh (or kvm) group id to something else, like this:

# groupmod -g 2137 _ssh

and then change gid of render so it matches host's:

# groupmod -g 104 render
@frysztak commented on GitHub (Oct 24, 2025): inside the container, you can change `_ssh` (or `kvm`) group id to something else, like this: ``` # groupmod -g 2137 _ssh ``` and then change gid of `render` so it matches host's: ``` # groupmod -g 104 render ```
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
🛑 Failure to comply with the guidelines
breaking change
bug
bug
bugfix
deferred
delete script
dependencies
enhancement
external
feature
github
help wanted
Implemented in VED waiting push to Main
in project pipeline
invalid
investigation
json
maintenance
new script
new script
nice to have
not a script issue
not planned
organization
pull-request
Mirrored from GitHub Pull Request
 question
refactor
rename script
security
update script
website
wontdo
No Label bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
saavagebueno
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: SVI/ProxmoxVE#1954
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?