[BUG] Selkies leaks /dev/dri/renderD128 file descriptors until "Too many open files"

[Dropje97]

Is there an existing issue for this?

• I have searched the existing issues

Current Behavior

After the container has been running for some time, the web UI starts logging repeated hardware encoding / file descriptor errors. Eventually the selkies process reaches its soft nofile limit and the web UI logs Too many open files.

The problem appears to be in the Selkies / Pixelflux / Wayland / VAAPI path rather than OrcaSlicer itself.

selkies reaches 1023 open file descriptors with a soft limit of 1024:

1023      342 selkies    1024/524288    /lsiopy/bin/python3 /lsiopy/bin/selkies --addr=localhost --mode=websockets

Inspecting the FD targets as the same UID/GID as selkies shows that almost all open FDs point to the DRM render node:

== grouped fd targets ==
    975 /dev/dri/renderD128
     16 socket:[...]
     13 /dmabuf:
     11 anon_inode:[...]
      4 pipe:[...]
      2 /memfd:[...] (deleted)
      1 /dev/null
      1 /config/.XDG/wayland-1.lock

The global file table is not exhausted:

/proc/sys/fs/file-nr:
21993   0       9223372036854775807

/proc/sys/fs/file-max:
9223372036854775807

Relevant visible log errors:

HW Encode Error: Failed to dup fd
[VAAPI @ ...] Failed to initialise VAAPI connection: 2 (resource allocation failure)
[Wayland] Failed to init VAAPI
[Wayland] Decision: No GPU Encoder available -> Using CPU Software Encoding
WARNING:webrtc_input:Error reading Wayland clipboard: [Errno 24] Too many open files

The clipboard error looks secondary; the FD leak itself is mostly /dev/dri/renderD128.

Expected Behavior

selkies should not continuously accumulate open file descriptors to /dev/dri/renderD128.

Failed VAAPI / zero-copy / hardware encoding attempts should clean up DRM/render-node descriptors and should not eventually exhaust the process nofile limit.

The container should keep running without repeated Failed to dup fd or Too many open files errors.

Steps To Reproduce

1. Run lscr.io/linuxserver/orcaslicer:v2.3.2-ls19 with /dev/dri passed through.
2. Enable Wayland / Pixelflux / GPU stream encoding using these relevant environment variables:

- PIXELFLUX_WAYLAND=true
- DRINODE=/dev/dri/renderD128
- DRI_NODE=/dev/dri/renderD128
- DRI_PRIME=0

3. Open the OrcaSlicer web UI in a browser.
4. Leave the container running and/or reconnect to the web UI a few times.
5. Observe repeated hardware encoding errors and later Too many open files.
6. Check open FDs in the container:

docker exec orcaslicer sh -lc '
for p in /proc/[0-9]*; do
  pid=${p##*/}
  comm=$(cat "$p/comm" 2>/dev/null || true)
  n=$(ls -1 "$p/fd" 2>/dev/null | wc -l)
  lim=$(awk "/Max open files/ {print \$4 \"/\" \$5}" "$p/limits" 2>/dev/null)
  printf "%8s %8s %-24s %s\n" "$n" "$pid" "$comm" "$lim"
done | sort -nr | head -10
'

7. Inspect FD targets as the same UID/GID as selkies:

pid=$(docker exec orcaslicer sh -lc 'for p in /proc/[0-9]*; do [ "$(cat "$p/comm" 2>/dev/null)" = "selkies" ] && { echo "${p##*/}"; break; }; done')
uid=$(docker exec orcaslicer sh -lc "awk '/^Uid:/ {print \$2}' /proc/$pid/status")
gid=$(docker exec orcaslicer sh -lc "awk '/^Gid:/ {print \$2}' /proc/$pid/status")

docker exec --user "$uid:$gid" -e TARGET_PID="$pid" orcaslicer sh -lc '
for fd in /proc/$TARGET_PID/fd/*; do
  readlink "$fd" 2>/dev/null
done | sed \
  -e "s/socket:\[[0-9]*\]/socket:[...]/" \
  -e "s/pipe:\[[0-9]*\]/pipe:[...]/" \
  -e "s/anon_inode:\[[^]]*\]/anon_inode:[...]/" \
  -e "s/memfd:[^ ]*/memfd:[...]/" \
| sort | uniq -c | sort -nr | head -30
'

Environment

- OS: Debian GNU/Linux 13 (trixie) inside a Proxmox LXC container
- Host kernel: Linux 6.17.13-2-pve x86_64
- Docker server version: 29.3.1
- Docker storage: Docker data on an ext4 block device inside the LXC
- Image: lscr.io/linuxserver/orcaslicer:v2.3.2-ls19
- Image version: v2.3.2-ls19
- Image revision: 71bb3d714599e449978d0c307777f0a447858816
- Image created: 2026-05-19T14:36:39+00:00
- How docker service was installed: distro's packagemanager

CPU architecture

x86-64

Docker creation

services:
  orcaslicer:
    image: lscr.io/linuxserver/orcaslicer:v2.3.2-ls19
    container_name: orcaslicer
    restart: unless-stopped

    devices:
      - /dev/dri:/dev/dri

    environment:
      - PUID=1000
      - PGID=1000
      - TZ=Europe/Amsterdam
      - PIXELFLUX_WAYLAND=true
      - DRINODE=/dev/dri/renderD128
      - DRI_NODE=/dev/dri/renderD128
      - DRI_PRIME=0
      - WEBKIT_DISABLE_COMPOSITING_MODE=1
      - WEBKIT_DISABLE_DMABUF_RENDERER=1
      - SELKIES_ENCODER=x264enc
      - MAX_RES=3840x2160
      - SELKIES_MANUAL_WIDTH=2560
      - SELKIES_MANUAL_HEIGHT=1380
      - NO_GAMEPAD=true
      - NO_FULL=true
      - HARD_DESKTOP=true
      - DISABLE_SUDO=true
      - DISABLE_TERMINAL=true
      - START_DOCKER=false
      - SELKIES_FILE_TRANSFERS=upload,download
      - SELKIES_UI_SIDEBAR_SHOW_FILES=true

    volumes:
      - /path/to/orcaslicer/config:/config
      - /etc/localtime:/etc/localtime:ro

Container logs

Relevant excerpts:


HW Encode Error: Failed to dup fd
[VAAPI @ ...] Failed to initialise VAAPI connection: 2 (resource allocation failure)
[Wayland] Failed to init VAAPI
[Wayland] Decision: No GPU Encoder available -> Using CPU Software Encoding
WARNING:webrtc_input:Error reading Wayland clipboard: [Errno 24] Too many open files

[github-actions]

Thanks for opening your first issue here! Be sure to follow the relevant issue templates, or risk having this issue marked as invalid.

[thelamer]

@Dropje97
Thank you for the detailed description, this seems to leak on encoder stop/starts (at least that is the only path I found fd leaks). 65ec456 addresses this on my system for both vaapi and nvenc.

Can you do me a favor and confirm this works for you I have built out a custom orcaslicer at the tag:

taisun/random-images:orca-no-fd-leak

Just swap that image out and run the same tests. You can off tab/on tab or anything else that stops and starts the encoder and you should notice the fds to the render device stay static for the life of the session.

Or optionally run it ephemerally to test:

docker run --name orcaslicer --rm -it \
  --shm-size=1gb \
  --device /dev/dri  \
  -e AUTO_GPU=true \
  -p 3001:3001 \
  taisun/random-images:orca-no-fd-leak bash

With your confirmation I'll cut a bugfix release of pixelflux and get it into the selkies baseimages.