New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Using --gpu with rootless podman #518
Comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
To use GPU acceleration with rootless podman, I need to be a member of the video and render groups, /dev/dri must be passed into the container, and the container user must also have access to the video and render groups.
The problem is that in rootless mode, --group-add creates a group in the user-namespace but the device nodes maintain their ownership in the host namespace. That means that although the 'video' and 'render' groups are added to the container, they have a different gid than on the host, and there is no access to the /dev/dri paths.
The fix for this is to use the 'crun' runtime, and to specify
--group-add keep-groups
and to NOT specify--group-add
for any other groups (apparently only crun supports the keep-groups option). This results in a weird container namespace where groups show asnobody
(because they have no names) but the user's groupids from the host are maintained and the container user can now access /dev/dri. More info can be found here:containers/podman#10166 (comment)
I've hacked x11docker so that it only passes
--group-add keep-groups
and it does indeed seem to be working properly. I'm not sure of the best way to implement this in x11docker though.The specific requirement is to be able to use:
x11docker --backend=podman --rootless=yes --xorg --gpu <some image> vainfo
In practice, my actual invocation looks like:
./x11docker --runtime=crun --keep-groups --xc=no --backend=podman --xorg --gpu --pulseaudio
(
--keep-groups
is the hack I applied to x11docker,--xc=no
is needed for podman-rootless)I need the refresh-rate switching from X11 so I didn't test wayland
The text was updated successfully, but these errors were encountered: