/dev/dri container access, plex, rootless

[adoreparler]

I've tried a bunch of different options with UserNS, group_add(GroupAdd) and few other random things from other posts I search. I cannot figure out how to get the user inside the plex container access to the /dev/dri/renderD128 device. If I run the container as rootful, it works just fine.

Quadlet, the quadlet below is the growing mess that it currently is.

[Unit]
Description=Plex Media Server

[Container]
Image=docker.io/plexinc/pms-docker:latest
AutoUpdate=registry

# PUID/PGID set to match host user, keeping userns for file system permissions 
Environment=PLEX_UID=1000
Environment=PLEX_GID=1000
Environment=TZ=America/New_York

#UserNS=keep-id
GroupAdd=keep-groups
ShmSize=8gb
Network=host

# Start container as root (needed for s6-init)
#User=0:0

# Config volumes
Volume=plex-config:/config
Volume=plex-transcode:/transcode
Volume=/media/alpha:/media/alpha

 # Add video device
AddDevice=/dev/dri:/dev/dri
 
[Install]
# Start by default on boot
WantedBy=default.target

On Host:

➜  podman top -l user huser
USER        HUSER
root        plex
root        plex
root        plex
plex        100999
plex        100999
plex        100999
plex        100999

Inside Container:

➜  podman exec -it systemd-plexmediaserver bash   
root@sirius:/# whoami
root
root@sirius:/# id
uid=0(root) gid=0(root) groups=0(root),65534(nogroup)
root@sirius:/# 

Inside Container:

root@sirius:/# ps -el
F S   UID     PID    PPID  C PRI  NI ADDR SZ WCHAN  TTY          TIME CMD
4 S     0       1       0  0  80   0 -    51 do_sys ?        00:00:00 s6-svscan
0 S     0      30       1  0  80   0 -    51 do_sys ?        00:00:00 s6-supervise
0 S     0     248       1  0  80   0 -    51 do_sys ?        00:00:00 s6-supervise
4 S  1000     250     248  1  80   0 - 37381 -      ?        00:00:01 Plex Media Serv
0 S  1000     283     250  1  95  15 - 16350 -      ?        00:00:00 Plex Script Hos
0 S  1000     317     250  0  80   0 - 10721 -      ?        00:00:00 Plex Tuner Serv
0 S  1000     358     250  0  80   0 - 16124 -      ?        00:00:00 Plex Script Hos
4 S     0     428       0  0  80   0 -  1467 do_wai pts/0    00:00:00 bash
0 R     0     460     428  0  80   0 -  1893 -      pts/0    00:00:00 ps

On Host:

➜ cat /etc/subuid
seion:100000:65536
media:231072:65536

➜  cat /etc/subgid
seion:100000:65536
media:231072:65536

On Host:

➜ ls -l /dev/dri
total 0
drwxr-xr-x 2 root root         80 Jan 28 17:30 by-path
crw-rw---- 1 root video  226,   0 Jan 28 17:30 card0
crw-rw---- 1 root render 226, 128 Jan 28 17:30 renderD128

In Container:

root@sirius:/# ls -l /dev/dri
total 0
crw-rw---- 1 nobody nogroup 226,   0 Jan 28 12:30 card0
crw-rw---- 1 nobody nogroup 226, 128 Jan 28 12:30 renderD128

I've added render and video groups to my user on host.

Postman info -> https://pastebin.com/tziw8jc0

[Luap99]

Note keep-groups can only work if the container itself does not call setgroups(), keep-groups simply works by not calling setgroups() in the oci runtime so that preserves your current user groups.
However the groups are still not mapped in the usersns because you do not have access to these gids in /etc/subgid.
As such when your container process s6 switched to the uid/gid of the plex process your group access will be lost.

So you either need a container image that does not do that, figure out a way for s6 not to do that or map the subgid of the group into the users mapping and then map the gid to the right gid (that can get quite complex, #18333)

[adoreparler]

does s6-setuidgid call setgroups?

[adoreparler]

I could try https://github.com/linuxserver/docker-plex , not sure if this one is doing the same thing with s6
Any suggestions with what parameters to use to get this to work with the linuxserver image (userns,group_add,ect..)

[adoreparler]

The linuxserver image works if I pass in the User=1000:1000 Directive. But I am unable to use the named volume anymore. But the below works without the named volume. So HW Accel Works in rootless now.

[Unit]
Description=Plex Media Server

[Container]
#Image=docker.io/plexinc/pms-docker:latest
Image=lscr.io/linuxserver/plex:latest
AutoUpdate=registry

# PUID/PGID set to match host user, keeping userns for file system permissions 
Environment=TZ=America/New_York
User=1000:1000

GroupAdd=keep-groups
ShmSize=8gb
Network=host

# Config volumes
#Volume=plex-config:/config
Volume=plex-transcode:/transcode
Volume=/media/alpha:/media/alpha
Volume=/media/beta:/media/beta
Volume=/opt/plex:/config

 # Add video device
AddDevice=/dev/dri:/dev/dri
 
[Install]
# Start by default on boot
WantedBy=default.target