hardware encoding must use uid=root?

[GavinIves]

In docker, when I enable Intel's core display for hardware encoding, my uid must be set to root, otherwise hardware decoding cannot be performed. Will this cause security issues? Or is there something wrong with my configuration?


but i use root, its ok!!!

maybe like emby,use GIDLIST # A comma-separated list of additional GIDs to run emby as (default: 2) to solve it
url: https://hub.docker.com/r/emby/embyserver

[lastzero]

As an alternative, you can try to run the PhotoPrism service as a non-root user by setting the PHOTOPRISM_UID environment variable in your docker-compose.yml file:

https://docs.photoprism.app/getting-started/advanced/docker-security/#run-services-as-non-root-user

It may also help to adjust the permissions of the related device:

https://docs.photoprism.app/getting-started/advanced/transcoding/#intel-quick-sync

If we need to change something in our Docker image to make it compatible with your specific environment, please let us know what exactly is needed. Thank you!

[lastzero]

See the create-users.sh script for the device groups and users currently supported:

photoprism/scripts/dist/create-users.sh

Lines 13 to 30 in e737083

	# create groups 'www-data', 'video', 'davfs2', and 'render'
	groupadd -f -r -g 33 www-data 1>&2
	echo "✅ added group www-data (33)"
	groupadd -f -r -g 44 video 1>&2
	echo "✅ added group video (44)"
	groupadd -f -r -g 105 davfs2 1>&2
	echo "✅ added group davfs2 (105)"
	groupadd -f -r -g 109 renderd 1>&2
	echo "✅ added group renderd (109)"
	groupadd -f -r -g 115 render 1>&2
	echo "✅ added group render (115)"
	groupadd -f -r -g 116 ssl-cert 1>&2
	echo "✅ added group ssl-cert (116)"
	# create group 'videodriver'
	groupdel -f 937 >/dev/null 2>&1
	groupadd -f -r -g 937 videodriver 1>&2
	echo "✅ added group videodriver (937)"

We've decided to go with that approach as you otherwise always have to start the container as root and can ONLY use the PHOTOPRISM_UID variable to change the UID later on. However, this means we might need to perform changes - for example add a new group - to allow using hardware transcoding on all devices & operating systems. In addition, the group ID 100 doesn't seem to be officially supported (supported GID ranges are 0, 33, 50-99, 500-600, and 900-1200 in addition to the GIDs shown in the script above).

What about you use GID 109? Will this solve your issue?

I also recommend checking related GitHub issues, for example:

• Hardware acceleration doesn't work when the container's (hardcoded) render group's GID doesn't match the host's #2739
• Videos: Improve hardware transcoding on Synology NAS devices #2228

[GavinIves]

uid=1100 gid=100 is supported. The official government just does not support uid. It is outside the range you mentioned. You remembered it wrongly. Aren't the uid and gid written here supposed to correspond to the permissions of my photo directory? So I need uid=1100 gid=100 gid=109 is the permission required to call renderd, and 44 is the permission to call video. Looking at the sh you sent, we can tell that he should have been added to the permissions, but I know that if uid=0 is not set, hardware decoding is unavailable. This is a very strange problem. I hope you can test it.

[lastzero]

I've spent the entire morning updating our docs to provide more specific guidance on Intel Video Transocoding and the UID/GID settings:

https://docs.photoprism.app/getting-started/advanced/transcoding/#intel-quick-sync

You are correct that the group 100 ("users") exists by default in the base Ubuntu image we are using. However, our script does not create it, so it may not be available in future base images, although it is unlikely that the Ubuntu maintainers will change this any time soon.

Since we have a long list of other requests and tasks to take care of so we can release a new stable version, this is all the help I can provide at this time. If you need another group to be added to our image, feel free to let us know so we can include it either in the next release or the release after that (next month).

[GavinIves]

Thank you very much. I understand what you mean. When we need to use the render, we must first obtain the gid of the render. getent group render | cut -d: -f3
Using the command on the host machine will return the gid. Just set our gid to it. I set the gid to 109 and successfully achieved the goal.Thanks again

[dmkiraly]

This command returned "107" on my host machine, which is not on the supported list. What do I do then?