incus storage volume set tank static-website security.shifted true
I’m not sure if I’m doing things correctly, the only way it works is security.shifted to true
if I’m set to false, I get this error
Failed to start device "static-website": Failed mounting volume: Failed shifting custom storage volume "static-website" on storage pool "tank": Idmaps of container and storage volume are not identical
I asked questions to LLMs, especially the latest one, Grok4, and it told me that having both values (shifted & privileged) set to true is not correct. Is that a hallucination?
I see that Scottibyte also uses shifted true when a container is in privileged mode.
security.shifted doesn’t really make sense when security.privileged it used as security.privileged makes it so the container doesn’t use a uid/gid map at all, so by definition, there’s no need to shift anything.
To give a bit more context, I simply want to add an Intel GPU to a container. Is it possible to do this without setting the container to security.privileged=true? Because for now, I can’t use my GPU inside the container.
Incus 6.14
# incus info --resources
GPU:
NUMA node: 0
Vendor: Intel Corporation (8086)
Product: Alder Lake-N [Intel Graphics] (46d4)
PCI address: 0000:00:02.0
Driver: i915 (6.12.38-1-lts)
DRM:
ID: 0
Card: card0 (226:0)
Control: controlD64 (226:0)
Render: renderD128 (226:128)
SR-IOV information:
Current number of VFs: 0
Maximum number of VFs: 7
I followed the instructions in this thread, but I still can’t get my Intel GPU to work inside the container. The only way it works is by setting the container to privileged.
Steps to reproduce
(host) # incus launch images:debian/12/amd64 test-gpu (unprivileged )
(host) # incus config device add test-gpu gpu gpu
(container) # apt install intel-gpu-tools
(container) # intel_gpu_top
(container) # Failed to initialize PMU! (Permission denied)
(container) # vainfo
libva info: VA-API version 1.17.0
libva info: Trying to open /usr/lib/x86_64-linux-gnu/dri/iHD_drv_video.so
libva info: Found init function __vaDriverInit_1_17
libva error: /usr/lib/x86_64-linux-gnu/dri/iHD_drv_video.so init failed
libva info: va_openDriver() returns 1
libva info: Trying to open /usr/lib/x86_64-linux-gnu/dri/i965_drv_video.so
libva info: va_openDriver() returns -1
vaInitialize failed with error code -1 (unknown libva error),exit
(container) # ffmpeg -hwaccel vaapi -hwaccel_device /dev/dri/renderD128 -hwaccel_output_format vaapi -i big_buck_bunny_720p_30mb.mp4 -c:v h264_vaapi -b:v 2M output_vaapi.mp4
libva: /usr/lib/x86_64-linux-gnu/dri/iHD_drv_video.so init failed
libva: /usr/lib/x86_64-linux-gnu/dri/i965_drv_video.so init failed
No device available for decoder: device type vaapi needed for codec h264.
Device setup failed for decoder on input stream #0:0 : Input/output error
I’m using a minimal Arch Linux setup with an Intel N150 GPU. I’ve updated the drivers
You’re adding GPU without proper GID, for example gid=44 (where 44 is the GID of video group inside your container). Also, make sure that the default user inside container belong to the video and renderer groups.
Okay, by sharing the logs—especially the one about the driver version—I just realized that the drivers weren’t the same version between my Arch host and my Debian container. I just tested with an Arch container, and everything works now.
I don’t even need to add the group ID. It work.
Host (arch)
[root@incus-arch ~]# pacman -Qs intel-media-driver
local/intel-media-driver 25.2.5-1
Intel Media Driver for VAAPI — Broadwell+ iGPUs
Container (arch)
# pacman -Qs intel-media-driver
local/intel-media-driver 25.2.5-1
Intel Media Driver for VAAPI — Broadwell+ iGPUs
The gid is needed if you want to run the commands as non-root in the container.
It helps to provide a full example with the set of commands to make it visible what’s going on. It helps because
it shows exactly what is being tried, so it can be reproduced
it replicates the full set of commands and new users can learn from your experience.
In your case, I would demonstrate that ffmpeg is running successfully on the host, then show that I create the container and set it up, and then try to demonstrate the thing that is not working. When I do that, I often find the solution to my question by myself just because I wrote down the steps in a straightforward way.
