New LXC Add Option - Device Passthrough

[tteck]

Has anyone tried this to see if it works in an unprivileged container?

[tteck]

110.conf

  GNU nano 7.2                                          /etc/pve/lxc/110.conf                                                   
#<div align='center'><a href='https%3A//Helper-Scripts.com' target='_blank' rel='noopener noreferrer'><img src='https%3A//raw.g>
#
#  # Debian LXC
#
#  <a href='https%3A//ko-fi.com/D1D7EP4GF'><img src='https%3A//img.shields.io/badge/&#x2615;-Buy me a coffee-blue' /></a>
#  </div>
arch: amd64
cores: 1
dev0: /dev/dri/card0
dev1: /dev/dri/renderD128
features: keyctl=1,nesting=1
hostname: debian
memory: 512
net0: name=eth0,bridge=vmbr0,hwaddr=AE:1A:60:07:B7:59,ip=dhcp,type=veth
onboot: 1
ostype: debian
rootfs: thin-pool:vm-110-disk-0,size=2G
swap: 512
tags: proxmox-helper-scripts
unprivileged: 1

[tteck]

root@debian:~# ls -l /dev/dri
total 0
crw-rw---- 1 root root 226,   0 Apr 24 06:29 card0
crw-rw---- 1 root root 226, 128 Apr 24 06:29 renderD128
root@debian:~#

[rcv11x]

i noticed just yesterday when i updated proxmox, it would be great to run the iGPU in an unprivileged container because i currently use jellyfin with privileged LXC and it is dangerous, it would solve all my problems because running the iGPU in a VM is very complicated ;/

[tripodsgames]

Using advanced settings to set the GID to render(104).
Works perfectly in unprivileged containers.

[rcv11x]

100% verified, it works with jellyfin!!!
this is incredible because now being non-privileged there is no risk as before.

[tteck]

Currently works only with 10bit HDR10，HLG and DoVi videos. This requires the corresponding OpenCL or CUDA runtime.

👨🏻‍🦱 My focus is on developing application LXC scripts, and maintaining said scripts. I do not specialize in, nor do I have the time to provide support for operational issues.

[rcv11x]

@tteck Sorry, I have an off topic question, these intel dependencies are installed on the proxmox host or inside the LXC? I installed them in the LXC I guess it's ok right?

[tteck]

LXC

[qnlbnsl]

@tteck Would it matter if i am running on AMD? seeing as it is trying to install intel-gpu-tools? or are you just setting up a catch all?

[tteck]

Installing Intel-specific software does not affect AMD processors.

[alve89]

Has anyone tried this to see if it works in an unprivileged container?

Which PVE version are you using? I don't see this option:

[tteck]

8.2

[di5cord20]

I'm running a Docker LXC container and made it privilaged to allow for HW Acceleration (used by Immich). Any suggestions for converting to unprivilaged? I can simply do an LXC restore and modify to unprivilaged, but I noticed above that approach may necessate addition steps to fix groups/permissions.

[egonzalez7579]

back up lxc, then restore,
should give the option to change ot

[EcN000]

Crazy coincidence I stumbled on to a such a recent post regarding this. I created a plex server about a month or so using your script and spent a whole day trying to pass through quicksync for plex.

Today I decided to run your script for a clean slate and I noticed that hardware transcoding worked out the box! The biggest thing I noticed was the addition of:

dev0: /dev/dri/card0,gid=44
dev1: /dev/dri/renderD128,gid=104

So I tried adding that to my old unprivileged plex lxc, but it didn't work. I decided to just migrate to the new container. I also noticed my old lxc was debian, but not sure if that was chosen explicitly by me.

Did you make a change to the plex script recently?
Edit: Wow I just saw the changelog that you just added it. Perfect timing!!!!
FYI in your note you specified not tested <8.2.

Works for me on 8.1.11.

Thank you!

[tteck]

Change Log updated! Thanks

[EcN000]

Would you be able to apply similar changes you made with plex/jellyfin with frigate? A lot of frigate users have coral tpu via pci as well as use igpu for processing.

[tteck]

It's on the list to try. 😉

[tteck]

d22dd10

[towerhand]

How are you mounting a shared drive? I tried using the unprivileged container, but I don't have the correct permissions to access my NFS folder that is binded to mp0.

[alve89]

From my /etc/pve/lxc/xxx.conf file:
mp0: /mnt/nfs,mp=/mnt/nfs
where mp is the hosts (= PVE mount point) and mp0 is the LXCs mount point.
You need to add the mount point on the host first and then add this path to the LXC.

[towerhand]

That's what I do, but the folder is showing as nobody:nogroup. Therefore, I can see the folder is there, but I have no permission to access it from the LXC.

[alve89]

I can't reproduce this issue, so just a general idea: Can't you chown the folder inside the LXC to your user?

[bigrichwood]

User/Group IDs will be different when accessing from the the LXC compared to the host. I had to set my NFS share to squash the permissions to either admin or guest before I could access it in the LXC.

This is with a read-only share mounted from my Synology NAS.

[towerhand]

alve89 I changed the folder owner from root:root to my user and the users group.

bigrichwood My NFS share is mounted from a Synology NAS too. I'll try creating a user with the same UID and GID on the proxmox host to see if that works since I would prefer avoiding to squash the permissions.