[BUG] Can't get hardware acceleration to work, no matter what. (Rootless docker; Debian 13)

[kurimanju-dev]

Is there an existing issue for this?

• I have searched the existing issues

Current Behavior

I know this is a common "issue" that happens with jellyfin docker and it's usually fixed by passing the correct group IDs for the render device to the container. I, however, cannot get it to work no matter what. I've set up groups correctly, passed the correct device(s) to the container and even recreated it from scratch multiple times.

For any attempt to get vainfo to show supported codecs, it keeps displaying:

hosting@VECTOR:/srv/jellyfin$ docker exec -it jellyfin /usr/lib/jellyfin-ffmpeg/vainfo
Trying display: drm
Failed to open the given device!

Same goes for:

hosting@VECTOR:/srv/jellyfin$ docker exec -it jellyfin /usr/lib/jellyfin-ffmpeg/ffmpeg -v verbose -init_hw_device vaapi=va -init_hw_device opencl@va
ffmpeg version 7.1.2-Jellyfin Copyright (c) 2000-2025 the FFmpeg developers
  built with gcc 13 (Ubuntu 13.3.0-6ubuntu2~24.04)
  configuration: --prefix=/usr/lib/jellyfin-ffmpeg --target-os=linux --extra-version=Jellyfin --disable-doc --disable-ffplay --disable-static --disable-libxcb --disable-sdl2 --disable-xlib --enable-lto=auto --enable-gpl --enable-version3 --enable-shared --enable-gmp --enable-gnutls --enable-chromaprint --enable-opencl --enable-libdrm --enable-libxml2 --enable-libass --enable-libfreetype --enable-libfribidi --enable-libfontconfig --enable-libharfbuzz --enable-libbluray --enable-libmp3lame --enable-libopus --enable-libtheora --enable-libvorbis --enable-libopenmpt --enable-libdav1d --enable-libsvtav1 --enable-libwebp --enable-libvpx --enable-libx264 --enable-libx265 --enable-libzvbi --enable-libzimg --enable-libfdk-aac --arch=amd64 --enable-libshaderc --enable-libplacebo --enable-vulkan --enable-vaapi --enable-amf --enable-libvpl --enable-ffnvcodec --enable-cuda --enable-cuda-llvm --enable-cuvid --enable-nvdec --enable-nvenc
  libavutil      59. 39.100 / 59. 39.100
  libavcodec     61. 19.101 / 61. 19.101
  libavformat    61.  7.100 / 61.  7.100
  libavdevice    61.  3.100 / 61.  3.100
  libavfilter    10.  4.100 / 10.  4.100
  libswscale      8.  3.100 /  8.  3.100
  libswresample   5.  3.100 /  5.  3.100
  libpostproc    58.  3.100 / 58.  3.100
[AVHWDeviceContext @ 0x55765c107880] Cannot open DRM render node for device 0.
[AVHWDeviceContext @ 0x55765c107880] Cannot open a VA display from DRM device (null).
Device creation failed: -542398533.
Failed to set value 'vaapi=va' for option 'init_hw_device': Generic error in an external library
Error parsing global options: Generic error in an external library

I have set up low power mode and passed the correct IDs to the container:

docker-compose.yml

---
services:
  jellyfin:
    image: lscr.io/linuxserver/jellyfin:latest
    container_name: jellyfin
    group_add:
      - '992'
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=Etc/UTC
      - DOCKER_MODS=linuxserver/mods:jellyfin-opencl-intel
    volumes:
      - ./config/library:/config
      - ./media:/media
    ports:
      - 8096:8096
    restart: unless-stopped
    devices:
      - /dev/dri:/dev/dri

hosting@VECTOR:/srv/jellyfin$ getent group render | cut -d: -f3
992

When entering the containers shell it displays groups: cannot find name for group ID 992:

hosting@VECTOR:/srv/jellyfin$ docker exec -it jellyfin /bin/bash
groups: cannot find name for group ID 992

Expected Behavior

No response

Steps To Reproduce

1. Setup docker rootless on debian 13 (trixie) according to the official docs/script
2. setup Jellyfin (linuxserver) using docker compose according to the official docs
3. pass /dev/dri(/renderD128|/card0) to the container along with the corresponding groups
4. start the container and test hardware acceleration

Environment

I have set up low power mode and passed the correct IDs to the container:

docker-compose.yml

---
services:
  jellyfin:
    image: lscr.io/linuxserver/jellyfin:latest
    container_name: jellyfin
    group_add:
      - '992'
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=Etc/UTC
      - DOCKER_MODS=linuxserver/mods:jellyfin-opencl-intel
    volumes:
      - ./config/library:/config
      - ./media:/media
    ports:
      - 8096:8096
    restart: unless-stopped
    devices:
      - /dev/dri:/dev/dri

hosting@VECTOR:/srv/jellyfin$ getent group render | cut -d: -f3
992

hosting@VECTOR:/srv/jellyfin$ ls -lan /dev/dri
total 0
drwxr-xr-x  3 0   0      100 Oct  8 16:02 .
drwxr-xr-x 19 0   0     3640 Oct  8 16:02 ..
drwxr-xr-x  2 0   0       80 Oct  8 16:02 by-path
crw-rw----  1 0  44 226,   0 Oct  8 16:02 card0
crw-rw----  1 0 992 226, 128 Oct  8 16:02 renderD128

OS: Debian 13
Docker was installed using the official script, same goes for rootless setup

I also tried passing group ID 44 to the container which didn't help. I've used Jellyfin on that Server before and I have to use /dev/dri/card0 for media. User hosting is also part of the video and render group:

hosting@VECTOR:/srv/jellyfin$ id hosting
uid=1000(hosting) gid=1000(hosting) groups=1000(hosting),44(video),992(render)

I've tried passing /dev/dri/renderD128 as well as /dev/dri/card0 together and separately to the container as well as their corresponding groups, without any improvements.

I have also installed all the different media dependencies I could find:

firmware-linux-nonfree, intel-media-va-driver, intel-media-va-driver-non-free and intel-opencl-icd

I have everything updated and obviously did reboot multiple times.

As mentioned before, Low Power mode is setup successfully:

root@VECTOR:/srv/jellyfin# sh -c "cat /sys/kernel/debug/dri/0/gt*/uc/guc_info"
GuC firmware: i915/glk_guc_70.1.1.bin
        status: RUNNING
        version: found 70.1.1
        uCode: 206400 bytes
        RSA: 256 bytes
GuC status 0x8002f077:
        Bootrom status = 0x3b
        uKernel status = 0xf0
        MIA Core status = 0x2
Scratch registers:
         0:     0xf0000000
         1:     0x1
         2:     0x1000
         3:     0x0
         4:     0x40
         5:     0x120c
         6:     0x31840006
         7:     0x0
         8:     0x0
         9:     0x0
        10:     0x0
        11:     0x0
        12:     0x0
        13:     0x0
        14:     0x0
        15:     0x0

GuC logging stats:
        Relay full count: 0
        DEBUG:  flush count          0, overflow count          0
        CRASH:  flush count          0, overflow count          0
        CAPTURE:        flush count          0, overflow count          0

root@VECTOR:/srv/jellyfin# sh -c "cat /sys/kernel/debug/dri/0/gt*/uc/huc_info"
HuC firmware: i915/glk_huc_4.0.0.bin
        status: RUNNING
        version: found 4.0.0
        uCode: 225664 bytes
        RSA: 256 bytes
HuC status: 0x00006080

CPU architecture

x86-64

Docker creation

---
services:
  jellyfin:
    image: lscr.io/linuxserver/jellyfin:latest
    container_name: jellyfin
    group_add:
      - '992'
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=Etc/UTC
      - DOCKER_MODS=linuxserver/mods:jellyfin-opencl-intel
    volumes:
      - ./config/library:/config
      - ./media:/media
    ports:
      - 8096:8096
    restart: unless-stopped
    devices:
      - /dev/dri:/dev/dri

Container logs

hosting@VECTOR:/srv/jellyfin$ docker logs jellyfin
[mod-init] Running Docker Modification Logic
[mod-init] Adding linuxserver/mods:jellyfin-opencl-intel to container
[mod-init] Downloading linuxserver/mods:jellyfin-opencl-intel from lscr.io
[mod-init] Installing linuxserver/mods:jellyfin-opencl-intel
[mod-init] linuxserver/mods:jellyfin-opencl-intel applied to container
[migrations] started
[migrations] no migrations found
───────────────────────────────────────

      ██╗     ███████╗██╗ ██████╗
      ██║     ██╔════╝██║██╔═══██╗
      ██║     ███████╗██║██║   ██║
      ██║     ╚════██║██║██║   ██║
      ███████╗███████║██║╚██████╔╝
      ╚══════╝╚══════╝╚═╝ ╚═════╝

   Brought to you by linuxserver.io
───────────────────────────────────────

To support the app dev(s) visit:
Jellyfin: https://opencollective.com/jellyfin

To support LSIO projects visit:
https://www.linuxserver.io/donate/

───────────────────────────────────────
GID/UID
───────────────────────────────────────

User UID:    1000
User GID:    1000
───────────────────────────────────────
**** Installing/updating opencl-intel legacy1 debs and adding clinfo to package install list ****
Selecting previously unselected package intel-igc-core.
(Reading database ... 10603 files and directories currently installed.)
Preparing to unpack .../intel-igc-core_1.0.17537.20_amd64.deb ...
Unpacking intel-igc-core (1.0.17537.20) ...
Selecting previously unselected package intel-igc-opencl.
Preparing to unpack .../intel-igc-opencl_1.0.17537.20_amd64.deb ...
Unpacking intel-igc-opencl (1.0.17537.20) ...
Selecting previously unselected package intel-level-zero-gpu-legacy1.
Preparing to unpack .../intel-level-zero-gpu-legacy1_1.3.30872.22_amd64.deb ...
Unpacking intel-level-zero-gpu-legacy1 (1.3.30872.22) ...
Selecting previously unselected package intel-opencl-icd-legacy1.
Preparing to unpack .../intel-opencl-icd-legacy1_24.35.30872.22_amd64.deb ...
Unpacking intel-opencl-icd-legacy1 (24.35.30872.22) ...
Selecting previously unselected package libigdgmm12:amd64.
Preparing to unpack .../libigdgmm12_22.5.0_amd64.deb ...
Unpacking libigdgmm12:amd64 (22.5.0) ...
Setting up intel-igc-core (1.0.17537.20) ...
Setting up intel-igc-opencl (1.0.17537.20) ...
Setting up libigdgmm12:amd64 (22.5.0) ...
Setting up intel-level-zero-gpu-legacy1 (1.3.30872.22) ...
Setting up intel-opencl-icd-legacy1 (24.35.30872.22) ...
Processing triggers for libc-bin (2.39-0ubuntu8.6) ...
**** Installing/updating opencl-intel debs and adding clinfo to package install list ****
Selecting previously unselected package intel-igc-core-2.
(Reading database ... 10638 files and directories currently installed.)
Preparing to unpack .../intel-igc-core-2_2.18.5+19820_amd64.deb ...
Unpacking intel-igc-core-2 (2.18.5) ...
Selecting previously unselected package intel-igc-opencl-2.
Preparing to unpack .../intel-igc-opencl-2_2.18.5+19820_amd64.deb ...
Unpacking intel-igc-opencl-2 (2.18.5) ...
Selecting previously unselected package intel-ocloc.
Preparing to unpack .../intel-ocloc_25.35.35096.9-0_amd64.deb ...
Unpacking intel-ocloc (25.35.35096.9-0) ...
Selecting previously unselected package intel-opencl-icd.
Preparing to unpack .../intel-opencl-icd_25.35.35096.9-0_amd64.deb ...
Unpacking intel-opencl-icd (25.35.35096.9-0) ...
Preparing to unpack .../libigdgmm12_22.8.1_amd64.deb ...
Unpacking libigdgmm12:amd64 (22.8.1) over (22.5.0) ...
Selecting previously unselected package libze-intel-gpu1.
Preparing to unpack .../libze-intel-gpu1_25.35.35096.9-0_amd64.deb ...
Unpacking libze-intel-gpu1 (25.35.35096.9-0) ...
Setting up intel-igc-core-2 (2.18.5) ...
Setting up intel-igc-opencl-2 (2.18.5) ...
Setting up intel-ocloc (25.35.35096.9-0) ...
Setting up libigdgmm12:amd64 (22.8.1) ...
Setting up libze-intel-gpu1 (25.35.35096.9-0) ...
Setting up intel-opencl-icd (25.35.35096.9-0) ...
Processing triggers for libc-bin (2.39-0ubuntu8.6) ...
[pkg-install-init] **** Installing all mod packages ****
Get:1 http://archive.ubuntu.com/ubuntu noble InRelease [256 kB]
Get:2 https://repo.jellyfin.org/ubuntu noble InRelease [10.6 kB]
Get:3 http://archive.ubuntu.com/ubuntu noble-updates InRelease [126 kB]
Get:5 http://archive.ubuntu.com/ubuntu noble-security InRelease [126 kB]
Get:6 http://archive.ubuntu.com/ubuntu noble/multiverse Sources [355 kB]
Get:4 https://ams1.mirror.jellyfin.org/files/ubuntu noble/main amd64 Packages [5,454 B]
Get:7 http://archive.ubuntu.com/ubuntu noble/universe Sources [24.3 MB]
Get:8 http://archive.ubuntu.com/ubuntu noble/restricted Sources [21.8 kB]
Get:9 http://archive.ubuntu.com/ubuntu noble/main Sources [1,713 kB]
Get:10 http://archive.ubuntu.com/ubuntu noble/main amd64 Packages [1,808 kB]
Get:11 http://archive.ubuntu.com/ubuntu noble/multiverse amd64 Packages [331 kB]
Get:12 http://archive.ubuntu.com/ubuntu noble/restricted amd64 Packages [117 kB]
Get:13 http://archive.ubuntu.com/ubuntu noble/universe amd64 Packages [19.3 MB]
Get:14 http://archive.ubuntu.com/ubuntu noble-updates/restricted Sources [70.8 kB]
Get:15 http://archive.ubuntu.com/ubuntu noble-updates/main Sources [583 kB]
Get:16 http://archive.ubuntu.com/ubuntu noble-updates/universe Sources [633 kB]
Get:17 http://archive.ubuntu.com/ubuntu noble-updates/multiverse Sources [28.1 kB]
Get:18 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 Packages [1,887 kB]
Get:19 http://archive.ubuntu.com/ubuntu noble-updates/universe amd64 Packages [1,925 kB]
Get:20 http://archive.ubuntu.com/ubuntu noble-updates/restricted amd64 Packages [2,625 kB]
Get:21 http://archive.ubuntu.com/ubuntu noble-updates/multiverse amd64 Packages [38.9 kB]
Get:22 http://archive.ubuntu.com/ubuntu noble-security/multiverse Sources [21.3 kB]
Get:23 http://archive.ubuntu.com/ubuntu noble-security/main Sources [253 kB]
Get:24 http://archive.ubuntu.com/ubuntu noble-security/universe Sources [408 kB]
Get:25 http://archive.ubuntu.com/ubuntu noble-security/restricted Sources [64.7 kB]
Get:26 http://archive.ubuntu.com/ubuntu noble-security/universe amd64 Packages [1,138 kB]
Get:27 http://archive.ubuntu.com/ubuntu noble-security/restricted amd64 Packages [2,498 kB]
Get:28 http://archive.ubuntu.com/ubuntu noble-security/main amd64 Packages [1,527 kB]
Get:29 http://archive.ubuntu.com/ubuntu noble-security/multiverse amd64 Packages [34.6 kB]
Fetched 62.2 MB in 5s (13.1 MB/s)
Reading package lists...
Reading package lists...
Building dependency tree...
Reading state information...
The following NEW packages will be installed:
  clinfo
0 upgraded, 1 newly installed, 0 to remove and 3 not upgraded.
Need to get 57.0 kB of archives.
After this operation, 184 kB of additional disk space will be used.
Get:1 http://archive.ubuntu.com/ubuntu noble/universe amd64 clinfo amd64 3.0.23.01.25-1build1 [57.0 kB]
Fetched 57.0 kB in 0s (435 kB/s)
Selecting previously unselected package clinfo.
(Reading database ... 10662 files and directories currently installed.)
Preparing to unpack .../clinfo_3.0.23.01.25-1build1_amd64.deb ...
Unpacking clinfo (3.0.23.01.25-1build1) ...
Setting up clinfo (3.0.23.01.25-1build1) ...
[custom-init] No custom files found, skipping...
[20:56:15] [INF] [1] Main: Jellyfin version: 10.10.7
[20:56:15] [INF] [1] Main: Environment Variables: ["[JELLYFIN_LOG_DIR, /config/log]", "[JELLYFIN_DATA_DIR, /config/data]", "[JELLYFIN_CACHE_DIR, /config/cache]", "[JELLYFIN_WEB_DIR, /usr/share/jellyfin/web]", "[JELLYFIN_CONFIG_DIR, /config]", "[JELLYFIN_PublishedServerUrl, https://jellyfin.weitl.xyz]"]
[20:56:15] [INF] [1] Main: Arguments: ["/usr/lib/jellyfin/bin/jellyfin.dll", "--ffmpeg=/usr/lib/jellyfin-ffmpeg/ffmpeg"]
[20:56:15] [INF] [1] Main: Operating system: Ubuntu 24.04.3 LTS
[20:56:15] [INF] [1] Main: Architecture: X64
[20:56:15] [INF] [1] Main: 64-Bit Process: True
[20:56:15] [INF] [1] Main: User Interactive: True
[20:56:15] [INF] [1] Main: Processor count: 4
[20:56:15] [INF] [1] Main: Program data path: /config/data
[20:56:15] [INF] [1] Main: Log directory path: /config/log
[20:56:15] [INF] [1] Main: Config directory path: /config
[20:56:15] [INF] [1] Main: Cache path: /config/cache
[20:56:15] [INF] [1] Main: Temp directory path: /tmp/jellyfin
[20:56:15] [INF] [1] Main: Web resources path: /usr/share/jellyfin/web
[20:56:15] [INF] [1] Main: Application directory: /usr/lib/jellyfin/bin/
[20:56:15] [INF] [1] Jellyfin.Server.Migrations.MigrationRunner: Marking following migrations as applied because this is a fresh install: ["CreateNetworkConfiguration", "MigrateMusicBrainzTimeout", "MigrateNetworkConfiguration", "MigrateEncodingOptions"]
[20:56:15] [INF] [1] Emby.Server.Implementations.AppBase.BaseConfigurationManager: Setting cache path: /config/cache
[20:56:15] [INF] [1] Emby.Server.Implementations.ApplicationHost: Loading assemblies
[20:56:15] [INF] [1] Jellyfin.Networking.Manager.NetworkManager: Defined LAN subnets: ["127.0.0.1/8", "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16"]
[20:56:15] [INF] [1] Jellyfin.Networking.Manager.NetworkManager: Defined LAN exclusions: []
[20:56:15] [INF] [1] Jellyfin.Networking.Manager.NetworkManager: Used LAN subnets: ["127.0.0.1/8", "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16"]
[20:56:15] [INF] [1] Jellyfin.Networking.Manager.NetworkManager: Filtered interface addresses: ["127.0.0.1", "172.19.0.2"]
[20:56:15] [INF] [1] Jellyfin.Networking.Manager.NetworkManager: Bind Addresses ["0.0.0.0"]
[20:56:15] [INF] [1] Jellyfin.Networking.Manager.NetworkManager: Remote IP filter is Allowlist
[20:56:15] [INF] [1] Jellyfin.Networking.Manager.NetworkManager: Filtered subnets: []
[20:56:17] [INF] [1] Emby.Server.Implementations.Plugins.PluginManager: Loaded plugin: TMDb 10.10.7.0
[20:56:17] [INF] [1] Emby.Server.Implementations.Plugins.PluginManager: Loaded plugin: Studio Images 10.10.7.0
[20:56:17] [INF] [1] Emby.Server.Implementations.Plugins.PluginManager: Loaded plugin: OMDb 10.10.7.0
[20:56:17] [INF] [1] Emby.Server.Implementations.Plugins.PluginManager: Loaded plugin: MusicBrainz 10.10.7.0
[20:56:17] [INF] [1] Emby.Server.Implementations.Plugins.PluginManager: Loaded plugin: AudioDB 10.10.7.0
[20:56:17] [INF] [1] Jellyfin.Server.Migrations.MigrationRunner: Marking following migrations as applied because this is a fresh install: ["DisableTranscodingThrottling", "CreateLoggingConfigHeirarchy", "MigrateActivityLogDatabase", "RemoveDuplicateExtras", "MigrateUserDatabase", "MigrateDisplayPreferencesDatabase", "RemoveDownloadImagesInAdvance", "MigrateAuthenticationDatabase", "FixPlaylistOwner", "MigrateRatingLevels", "FixAudioData", "RemoveDuplicatePlaylistChildren"]
[20:56:17] [INF] [1] Main: Kestrel is listening on 0.0.0.0
[20:56:18] [WRN] [1] Microsoft.AspNetCore.StaticFiles.StaticFileMiddleware: The WebRootPath was not found: /run/s6-rc:s6-rc-init:cHFCcf/servicedirs/svc-jellyfin/wwwroot. Static files may be unavailable.
[20:56:18] [INF] [1] Emby.Server.Implementations.ApplicationHost: Running startup tasks
[20:56:18] [INF] [1] Emby.Server.Implementations.ScheduledTasks.TaskManager: Daily trigger for Generate Trickplay Images set to fire at 2025-10-09 03:00:00.000 +00:00, which is 06:03:41.1796487 from now.
[20:56:18] [INF] [1] Emby.Server.Implementations.ScheduledTasks.TaskManager: Daily trigger for Extract Chapter Images set to fire at 2025-10-09 02:00:00.000 +00:00, which is 05:03:41.1611940 from now.
[20:56:18] [INF] [1] MediaBrowser.MediaEncoding.Encoder.MediaEncoder: Found ffmpeg version 7.1.2
[20:56:18] [INF] [1] MediaBrowser.MediaEncoding.Encoder.MediaEncoder: Available decoders: ["libdav1d", "av1", "av1_cuvid", "av1_qsv", "h264", "h264_qsv", "h264_cuvid", "hevc", "hevc_qsv", "hevc_cuvid", "mpeg2video", "mpeg2_qsv", "mpeg2_cuvid", "mpeg4", "mpeg4_cuvid", "msmpeg4", "vc1_qsv", "vc1_cuvid", "vp8", "libvpx", "vp8_cuvid", "vp8_qsv", "vp9", "libvpx-vp9", "vp9_cuvid", "vp9_qsv", "aac", "ac3", "ac4", "dca", "flac", "mp3", "truehd"]
[20:56:18] [INF] [1] MediaBrowser.MediaEncoding.Encoder.MediaEncoder: Available encoders: ["libsvtav1", "av1_nvenc", "av1_qsv", "av1_amf", "av1_vaapi", "libx264", "h264_amf", "h264_nvenc", "h264_qsv", "h264_v4l2m2m", "h264_vaapi", "libx265", "hevc_amf", "hevc_nvenc", "hevc_qsv", "hevc_vaapi", "mjpeg_qsv", "mjpeg_vaapi", "aac", "libfdk_aac", "ac3", "alac", "dca", "flac", "libmp3lame", "libopus", "truehd", "libvorbis", "srt"]
[20:56:19] [INF] [1] MediaBrowser.MediaEncoding.Encoder.MediaEncoder: Available filters: ["bwdif_cuda", "deinterlace_qsv", "deinterlace_vaapi", "flip_vulkan", "hwupload_cuda", "hwupload_vaapi", "libplacebo", "overlay_opencl", "overlay_qsv", "overlay_vaapi", "overlay_vulkan", "overlay_cuda", "procamp_vaapi", "scale_cuda", "scale_opencl", "scale_qsv", "scale_vaapi", "scale_vulkan", "tonemapx", "tonemap_cuda", "tonemap_opencl", "tonemap_vaapi", "transpose_cuda", "transpose_opencl", "transpose_vaapi", "transpose_vulkan", "vpp_qsv", "yadif_cuda", "zscale", "alphasrc"]
[20:56:19] [INF] [1] MediaBrowser.MediaEncoding.Encoder.MediaEncoder: Available hwaccel types: ["cuda", "vaapi", "qsv", "drm", "opencl", "vulkan"]
[20:56:21] [INF] [16] Emby.Server.Implementations.ScheduledTasks.TaskManager: Clean Transcode Directory Completed after 0 minute(s) and 0 seconds
[20:56:21] [INF] [17] Emby.Server.Implementations.ScheduledTasks.TaskManager: Clean up collections and playlists Completed after 0 minute(s) and 0 seconds
[20:56:22] [INF] [8] Emby.Server.Implementations.ScheduledTasks.TaskManager: Update Plugins Completed after 0 minute(s) and 0 seconds
[20:56:25] [INF] [1] MediaBrowser.MediaEncoding.Encoder.MediaEncoder: FFmpeg: /usr/lib/jellyfin-ffmpeg/ffmpeg
[20:56:25] [INF] [1] Emby.Server.Implementations.ApplicationHost: ServerId: 81e6c0e8efa040fb998bf96a568094a1
[20:56:25] [INF] [1] Emby.Server.Implementations.ApplicationHost: Core startup complete
[20:56:25] [INF] [1] Main: Startup complete 0:00:10.1239189
[ls.io-init] done.

[github-actions]

Thanks for opening your first issue here! Be sure to follow the relevant issue templates, or risk having this issue marked as invalid.

[mwahlhuetter]

I struggled with the same problem on 10.11.0.
Set up a new docker container on a new server (also debian 13) and hw acceleration did not work.
I think a found the cause. the group videoggr4 does not exist anymore. in the older version this was assigned to the renderD128 device. Also the user abc is not in the video group anymore, thats the main issue i think. After just adding video group to abc user transcoding started working after a restart of the container.
For my specific case i also had to configure the lxc device binding to both use group video and not video and render because of the missing group videoggr4 in the docker container.

[aptalca]

Wait, you're doing all this in lxc? And rootless docker? That's asking for a bad time.

[LinuxServer-CI]

This issue has been automatically marked as stale because it has not had recent activity. This might be due to missing feedback from OP. It will be closed if no further activity occurs. Thank you for your contributions.

[papykhader]

Hello, I’m experiencing the same issue using Proxmox → unprivileged LXC → Docker. Solution below. 💙

In my setup, the /dev/dri/renderD128 device is correctly mapped into the LXC container and belongs to the render group (typically GID 104 on Debian). Running vainfo inside of the LXC container confirms it’s accessible.

root@docker-1:~# vainfo libva info: VA-API version 1.17.0 libva info: Trying to open /usr/lib/x86_64-linux-gnu/dri/iHD_drv_video.so libva info: Found init function __vaDriverInit_1_17 libva info: va_openDriver() returns 0 vainfo: VA-API version: 1.17 (libva 2.12.0) vainfo: Driver version: Intel iHD driver for Intel(R) Gen Graphics - 23.1.1 ()

But once inside the Jellyfin Docker container, the device is not accessible anymore because the device belongs to the group id 104 and there is no group matching, and so the user running jellyfin (usually abc) does not have access to the renderD128 device.

root@9887d5284f4d:/# ls -la /dev/dri/
total 0
drwxr-xr-x 2 root root        80 Dec 10 17:56 .
drwxr-xr-x 6 root root       360 Dec 10 17:56 ..
crw-rw---- 1 root video 226,   1 Dec 10 17:56 card1
crw-rw---- 1 root   **104** 226, 128 Dec 10 17:56 renderD128

# Process ran with privilege of user `abc`
root@9887d5284f4d:/# ps -eo user,comm
USER     COMMAND
root     s6-svscan
....
**abc      jellyfin**

root@9887d5284f4d:/# id abc
uid=1000(abc) gid=1000(abc) **groups=1000(abc),100(users)**

According to the documentation LinuxServer Jellyfin:

To leverage hardware acceleration you will need to mount /dev/dri inside the container.
--device=/dev/dri:/dev/dri
We will automatically ensure the abc user inside the container has the proper permissions to access this device.

There is indeed an s6 initialization script embedded in the linuxserver jellyfin docker image that is supposed to take care of that, but it fails in this case.

It fails because Proxmox mounts the device as tmpfs inside an unprivileged LXC. The Jellyfin Docker container initialization script attempts to detect rendering devices and create the necessary groups, adding the user running Jellyfin to them. The detection line in root/etc/s6-overlay/s6-rc.d/init-jellyfin-video/run uses:

find /dev/dri /dev/dvb /dev/vchiq /dev/vc-mem /dev/video1? -type c -print 2>/dev/null

The -type c filter causes the device to be ignored, because tmpfs-mounted devices inside an unprivileged container are not recognized by find as character devices, even though ls and stat report them as such.

root@docker-1:~# ls -la /dev/dri/
crw-rw---- 1 root video  226,   1 card1
crw-rw---- 1 root 104    226, 128 renderD128

root@docker-1:~# file /dev/dri/*
/dev/dri/card1:      character special (226/1)
/dev/dri/renderD128: character special (226/128)

root@docker-1:~# find /dev/dri -maxdepth 1 -printf "%p %y\n"
/dev/dri d
/dev/dri/card1 **f**
/dev/dri/renderD128 **f**

Solution

In my case, I solved this by creating a custom entrypoint.sh for Docker that:

1. Creates a group with GID matching renderD128 (in my case, 104).
2. Adds the abc user to this group.

This ensures Jellyfin/FFmpeg have access to the rendering device inside an unprivileged container, without modifying the upstream s6 script.

entrypoint.sh

#!/bin/bash
set -e

# Target GID for /dev/dri/renderD128
RENDER_GID=104
JELLYFIN_USER=abc

# Check if group with GID 104 exists
GROUP_NAME=$(getent group "$RENDER_GID" | cut -d: -f1)

if [ -z "$GROUP_NAME" ]; then
    # Create a new group with the target GID
    GROUP_NAME="render104"
    echo "Creating group $GROUP_NAME with GID $RENDER_GID"
    groupadd -g "$RENDER_GID" "$GROUP_NAME"
else
    echo "Group with GID $RENDER_GID already exists: $GROUP_NAME"
fi

# Add Jellyfin user to the group
if id "$JELLYFIN_USER" >/dev/null 2>&1; then
    echo "Adding user $JELLYFIN_USER to group $GROUP_NAME"
    usermod -aG "$GROUP_NAME" "$JELLYFIN_USER"
else
    echo "User $JELLYFIN_USER not found! Exiting."
    exit 1
fi

# Execute the original container CMD
exec "$@"

compose.yaml

jellyfin:
    image: lscr.io/linuxserver/jellyfin:latest
   [redacted]
    devices:
      - /dev/dri:/dev/dri
    environment:
      - PUID=${PUID}
      - PGID=${PGID}
      - UMASK=022
      - TZ=${TZ}
      - DOCKER_MODS=linuxserver/mods:jellyfin-opencl-intel
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - ./entrypoint.sh:/entrypoint.sh:ro
    entrypoint: ["/entrypoint.sh"]
    command: ["/init"]

Hope it helps! 💙

[JonathanTreffler]

I found a simple solution, that does not need any changes to the docker image, entrypoint or the s6 services, that works after the changes made in #315 (meaning for any version after 10.11.4ubu2404-ls12).

If you run this docker in an unprivileged LXC on Proxmox (an installation method with MANY upsides, no I don't care some Proxmox dev once said in a forum post somewhere that you should use a VM which some people take as gospel for no reason) this should work for you:

Simply set the env variable ATTACHED_DEVICES_PERMS to /dev/dri /dev/dvb /dev/vchiq /dev/vc-mem /dev/video1? -type c -o -type f (the default value is /dev/dri /dev/dvb /dev/vchiq /dev/vc-mem /dev/video1? -type c).

For docker compose this means:

environment:
  [... your other envs ...]
  ATTACHED_DEVICES_PERMS: "/dev/dri /dev/dvb /dev/vchiq /dev/vc-mem /dev/video1? -type c -o -type f"