Load radeon driver instead of llvmpipe.

[GamePlayer-8]

Good evening,

I'm having an issue with properly loading a radeon driver & using it inside a runc container.
The actual result is loading an llvmpipe which is not what I want.

I've tried rbinding a /dev/dri directory along with /dev/pts,/dev/shm,/dev/mqueue etc directories but no luck.
I've also tried using capabilities, listed below:

"CAP_AUDIT_WRITE",
"CAP_KILL",
"CAP_NET_BIND_SERVICE",
"CAP_NET_RAW",
"CAP_CHOWN",
"CAP_DAC_OVERRIDE",
"CAP_FOWNER",
"CAP_FSETID",
"CAP_SETFCAP",
"CAP_SETGID",
"CAP_SETPCAP",
"CAP_SETUID",
"CAP_SYS_CHROOT",
"CAP_SYS_ADMIN",
"CAP_NET_ADMIN",
"CAP_SYS_RAWIO",
"CAP_DAC_READ_SEARCH",
"CAP_SYS_PTRACE"

although it doesn't worked.

What should I do to make radeon card detected and used by the container?

(a side note: radeon-profile software can read /dev/dri/card0 properly inside a container, the graphics card works totally fine on the host).

[cyphar]

Have you added allow rules to the device resources configuration? The devices cgroup restricts what operations are allowed on specific character and block devices, and the default setting will block GPU access.

Docker does this automatically if you use --device but because runc is a lower-level tool, you will need to do the configuration yourself.

[GamePlayer-8]

how do I modify the device resources's configuration?

[cyphar]

https://github.com/opencontainers/runtime-spec/blob/main/config-linux.md#allowed-device-list explains the format of the section of config.json.

[GamePlayer-8]

So do I need to insert inside linux / resources / devices:

{
	"allow": true,
	"access": "rwm"
},
{
	"allow": true,
	"type": "c",
	"major": 10,
	"minor": 229,
	"access": "rw"
},
{
	"allow": true,
	"type": "b",
	"major": 8,
	"minor": 0,
	"access": "rw"
}

or:

{
	"allow": true,
	"type": "a",
	"major": 0,
	"minor": 0,
	"access": "rw"
}

[cyphar]

Both of those options will allow the container to create and operate on any block or character device on the system (including your hard-drive, console, etc -- though the second configuration wouldn't allow mknod(2) which would slightly safer unless you run untrusted images).

If you want to have a secure configuration, you would want something like:

{
	"allow": false,
	"access": "rwm"
},
{
	"allow": true,
	"type": "c",
	"major": 10,
	"minor": 229,
	"access": "rw"
},
{
	"allow": true,
	"type": "b",
	"major": 8,
	"minor": 0,
	"access": "rw"
}

The first allow: false entry is needed in order to make the configuration a default-deny list.

(I don't know the major and minor numbers of your graphics card. Presumably radeon allocates a specific major number so you can allow-list the whole major if you'd prefer -- you can do that by setting minor to -1. Take a look at the contents of /proc/devices for all registered major numbers on your system.)

[GamePlayer-8]

so for type c do I need to set minor to -1 and leave major as 10?

Also here's my /proc/devices:

Character devices:
  1 mem
  4 /dev/vc/0
  4 tty
  4 ttyS
  5 /dev/tty
  5 /dev/console
  5 /dev/ptmx
  7 vcs
 10 misc
 13 input
 29 fb
 81 video4linux
116 alsa
128 ptm
136 pts
180 usb
188 ttyUSB
189 usb_device
202 cpu/msr
203 cpu/cpuid
226 drm
235 binder
236 media
237 kfd
238 aux
239 cec
240 hidraw
241 wwan_port
242 bsg
243 watchdog
244 remoteproc
245 ptp
246 pps
247 lirc
248 rtc
249 dma_heap
250 dax
251 dimmctl
252 ndctl
253 tpm
254 gpiochip
261 accel

Block devices:
  7 loop
  8 sd
 65 sd
 66 sd
 67 sd
 68 sd
 69 sd
 70 sd
 71 sd
128 sd
129 sd
130 sd
131 sd
132 sd
133 sd
134 sd
135 sd
259 blkext