+- Jellyfin Forum (https://forum.jellyfin.org)
+-- Forum: Support (https://forum.jellyfin.org/f-support)
+--- Forum: Troubleshooting (https://forum.jellyfin.org/f-troubleshooting)
+--- Thread: SOLVED: Jellyfin HW transcode (VA-API) on k3s keeps failing (Host issue?) (/t-solved-jellyfin-hw-transcode-va-api-on-k3s-keeps-failing-host-issue)
Jellyfin HW transcode (VA-API) on k3s keeps failing (Host issue?) - lilajka - 2025-08-29
Hello, I know this is probably issue on the host, not jellyfin itself, but Im having trouble with transcoding, or to better say with N150 graphics in general.
TL;DR: Jellyfin pod can see /dev/dri, but VA-API fails with Failed to open the given device! / No VA display found / iHD init failed. After lots of k8s/container tweaks, it looks like a host-side problem: on Ubuntu 24.04 my Asus NUC Essential 14 (N150) wouldn’t init.
Environment
- Host: Ubuntu 24.04 (Noble), originally 6.14.0-29-generic, fresh install
- Hardware: ASUS mini PC “asusnuc”, Intel N150 (Alder Lake-N), iGPU PCI ID shows as 8086:46d4; 2.5G Ethernet (exact model TBD — either Intel i225/i226 igc or Realtek RTL8125 r8125)
- nodeSelector: highperf: "true" (only this node has iGPU)
- Volumes: /config, /cache, media PVCs, and hostPath /dev/dri
- Security: supplementalGroups: [992, 44] (host render, video)
- Env: LIBVA_DRIVER_NAME=iHD
- Images tried: ghcr.io/jellyfin/jellyfin:latest and lscr.io/linuxserver/jellyfin
Goal: enable Quick Sync (VA-API) transcoding in Jellyfin on this node.
Symptoms
In the container
- vainfo --display drm --device /dev/dri/renderD128 → Failed to open the given device!
- Jellyfin’s FFmpeg with VA-API:No VA display found for device /dev/dri/renderD128. Device creation failed: -22.
- When -init_hw_device vaapi=va:... fails, -filter_hw_device va then errors with Invalid filter device va.
On the host
- vainfo --display drm --device /dev/dri/renderD128 prints:
Code:
libva info: VA-API version 1.20.0
libva info: User environment variable requested driver 'iHD'
libva info: Trying to open /usr/lib/x86_64-linux-gnu/dri/iHD_drv_video.so
libva info: Found init function __vaDriverInit_1_20
libva error: /usr/lib/x86_64-linux-gnu/dri/iHD_drv_video.so init failed
libva info: va_openDriver() returns 1
vaInitialize failed with error code 1 (operation failed),exitKernel logs show i915 loaded, DMC v2.20, GuC 70.36, HuC 7.9.3 → firmware looked fine.
What I tried (chronological highlights)
Kubernetes / container side
- Mounted /dev/dri into the pod (initially readOnly: true → changed to RW).
- Set supplementalGroups to host GIDs: render=992, video=44. Confirmed inside pod: id shows groups 992,44.
- Set LIBVA_DRIVER_NAME=iHD env in the container.
- (Temp) tried privileged: true, seccomp: Unconfined, AppArmor: Unconfined.
- Inside the Debian-based image, enabled non-free + non-free-firmware and installed:
- intel-media-va-driver-non-free, vainfo
- Verified iHD_drv_video.so exists; still failed to open VA display.
- Switched to linuxserver/jellyfin image (which normally handles /dev/dri perms for the abc user).
Host side (6.14)
- Ensured user is in render group; checked /dev/dri/renderD128 permissions (crw-rw---- root:render).
- Reinstalled userspace: intel-media-va-driver-non-free libva2 libdrm2 libigdgmm12 vainfo.
- Tried unloading xe (it wasn’t bound anyway).
- Tried kernel param i915.enable_pxp=0. Still iHD init failed.
- Connecting display to ASUS NUC & adding GRUB_CMDLINE_LINUX_DEFAULT="i915.enable_pxp=0 i915.modeset=1 i915.enable_guc=3 video=DP-1:1920x1080@60e quiet splash"
System report:
Code:
=== KERNEL & MODULES ===
6.14.0-29-generic
Driver (card0): no card0
Driver (renderD128): /sys/bus/pci/drivers/i915
Loaded modules:
xe 3428352 0
drm_gpuvm 45056 1 xe
gpu_sched 61440 1 xe
drm_ttm_helper 16384 1 xe
drm_exec 12288 2 drm_gpuvm,xe
drm_suballoc_helper 20480 1 xe
i915 4714496 12
drm_buddy 24576 2 xe,i915
ttm 118784 3 drm_ttm_helper,xe,i915
drm_display_helper 278528 2 xe,i915
cec 94208 3 drm_display_helper,xe,i915
i2c_algo_bit 16384 2 xe,i915
intel_vsec 20480 2 intel_pmc_core,xe
video 77824 4 asus_wmi,asus_nb_wmi,xe,i915
i915.ko present?
/lib/modules/6.14.0-29-generic/kernel/drivers/gpu/drm/i915/i915.ko.zst
filename: /lib/modules/6.14.0-29-generic/kernel/drivers/gpu/drm/i915/i915.ko.zst
srcversion: 18AD0B385BA537B78D31B02
vermagic: 6.14.0-29-generic SMP preempt mod_unload modversions
parm: invert_brightness:Invert backlight brightness (-1 force normal, 0 machine defaults, 1 force inversion), please report PCI device ID, subsystem vendor and subsystem device ID to dri-devel@lists.freedesktop.org, if your machine needs it. It will then be included in an upcoming module version. (int)
=== DRM DEVICES ===
total 0
drwxr-xr-x 2 root root 80 Aug 29 14:26 by-path
crw-rw----+ 1 root video 226, 1 Aug 29 14:33 card1
crw-rw----+ 1 root render 226, 128 Aug 29 14:26 renderD128
=== FIRMWARE (DMC/GuC/HuC) ===
Aug 29 14:26:39 asusnuc kernel: Command line: BOOT_IMAGE=/vmlinuz-6.14.0-29-generic root=UUID=2b302797-6909-4c5b-82fd-d1be03866ed5 ro i915.enable_pxp=0 quiet splash vt.handoff=7
Aug 29 14:26:39 asusnuc kernel: Kernel command line: BOOT_IMAGE=/vmlinuz-6.14.0-29-generic root=UUID=2b302797-6909-4c5b-82fd-d1be03866ed5 ro i915.enable_pxp=0 quiet splash vt.handoff=7
Aug 29 14:26:42 asusnuc kernel: i915: unknown parameter 'enable_pxp' ignored
Aug 29 14:26:42 asusnuc kernel: i915 0000:00:02.0: [drm] Found alderlake_p/alderlake_n (device ID 46d4) integrated display version 13.00 stepping D0
Aug 29 14:26:42 asusnuc kernel: i915 0000:00:02.0: [drm] VT-d active for gfx access
Aug 29 14:26:42 asusnuc kernel: i915 0000:00:02.0: vgaarb: deactivate vga console
Aug 29 14:26:42 asusnuc kernel: i915 0000:00:02.0: [drm] Using Transparent Hugepages
Aug 29 14:26:42 asusnuc kernel: i915 0000:00:02.0: vgaarb: VGA decodes changed: olddecodes=io+mem,decodes=io+mem:owns=io+mem
Aug 29 14:26:42 asusnuc kernel: i915 0000:00:02.0: [drm] Finished loading DMC firmware i915/adlp_dmc.bin (v2.20)
Aug 29 14:26:42 asusnuc kernel: i915 0000:00:02.0: [drm] GT0: GuC firmware i915/tgl_guc_70.bin version 70.36.0
Aug 29 14:26:42 asusnuc kernel: i915 0000:00:02.0: [drm] GT0: HuC firmware i915/tgl_huc.bin version 7.9.3
Aug 29 14:26:42 asusnuc kernel: i915 0000:00:02.0: [drm] GT0: HuC: authenticated for all workloads
Aug 29 14:26:42 asusnuc kernel: i915 0000:00:02.0: [drm] GT0: GUC: submission enabled
Aug 29 14:26:42 asusnuc kernel: i915 0000:00:02.0: [drm] GT0: GUC: SLPC enabled
Aug 29 14:26:42 asusnuc kernel: i915 0000:00:02.0: [drm] GT0: GUC: RC enabled
Aug 29 14:26:42 asusnuc kernel: mei_pxp 0000:00:16.0-fbf6fcf1-96cf-4e2e-a6a6-1bab8cbe36b1: bound 0000:00:02.0 (ops i915_pxp_tee_component_ops [i915])
Aug 29 14:26:42 asusnuc kernel: i915 0000:00:02.0: [drm] Protected Xe Path (PXP) protected content support initialized
Aug 29 14:26:42 asusnuc kernel: mei_hdcp 0000:00:16.0-b638ab7e-94e2-4ea2-a552-d1c54b627f04: bound 0000:00:02.0 (ops i915_hdcp_ops [i915])
Aug 29 14:26:42 asusnuc kernel: [drm] Initialized i915 1.6.0 for 0000:00:02.0 on minor 1
Aug 29 14:26:42 asusnuc kernel: fbcon: i915drmfb (fb0) is primary device
Aug 29 14:26:42 asusnuc kernel: i915 0000:00:02.0: [drm] fb0: i915drmfb frame buffer device
Aug 29 14:26:42 asusnuc kernel: snd_hda_intel 0000:00:1f.3: bound 0000:00:02.0 (ops i915_audio_component_bind_ops [i915])
=== USERS & PERMS ===
uid=1000(dano) gid=1000(dano) groups=1000(dano),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),100(users),114(lpadmin),992(render)
render:x:992:dano,jellyfin
User in render?
render
=== USERSPACE PACKAGES ===
WARNING: apt does not have a stable CLI interface. Use with caution in scripts.
intel-media-va-driver-non-free:
Installed: 24.1.0+ds1-1
Candidate: 24.1.0+ds1-1
Version table:
*** 24.1.0+ds1-1 500
500 http://archive.ubuntu.com/ubuntu noble/multiverse amd64 Packages
100 /var/lib/dpkg/status
i965-va-driver:
Installed: (none)
Candidate: 2.4.1+dfsg1-1build2
Version table:
2.4.1+dfsg1-1build2 500
500 http://archive.ubuntu.com/ubuntu noble/universe amd64 Packages
libva2:
Installed: 2.20.0-2build1
Candidate: 2.20.0-2build1
Version table:
*** 2.20.0-2build1 500
500 http://archive.ubuntu.com/ubuntu noble/universe amd64 Packages
100 /var/lib/dpkg/status
libdrm2:
Installed: 2.4.122-1~ubuntu0.24.04.1
Candidate: 2.4.122-1~ubuntu0.24.04.1
Version table:
*** 2.4.122-1~ubuntu0.24.04.1 500
500 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 Packages
100 /var/lib/dpkg/status
2.4.120-2build1 500
500 http://archive.ubuntu.com/ubuntu noble/main amd64 Packages
libigdgmm12:
Installed: 22.3.17+ds1-1
Candidate: 22.3.17+ds1-1
Version table:
*** 22.3.17+ds1-1 500
500 http://archive.ubuntu.com/ubuntu noble/universe amd64 Packages
100 /var/lib/dpkg/status
=== VA-API DRIVERS ON DISK ===
lrwxrwxrwx 1 root root 40 May 23 17:16 /usr/lib/x86_64-linux-gnu/dri/d3d12_drv_video.so -> ../libgallium-25.0.7-0ubuntu0.24.04.1.so
-rw-r--r-- 1 root root 36102104 Dec 29 2023 /usr/lib/x86_64-linux-gnu/dri/iHD_drv_video.so
lrwxrwxrwx 1 root root 40 May 23 17:16 /usr/lib/x86_64-linux-gnu/dri/nouveau_drv_video.so -> ../libgallium-25.0.7-0ubuntu0.24.04.1.so
lrwxrwxrwx 1 root root 40 May 23 17:16 /usr/lib/x86_64-linux-gnu/dri/r600_drv_video.so -> ../libgallium-25.0.7-0ubuntu0.24.04.1.so
lrwxrwxrwx 1 root root 40 May 23 17:16 /usr/lib/x86_64-linux-gnu/dri/radeonsi_drv_video.so -> ../libgallium-25.0.7-0ubuntu0.24.04.1.so
lrwxrwxrwx 1 root root 40 May 23 17:16 /usr/lib/x86_64-linux-gnu/dri/virtio_gpu_drv_video.so -> ../libgallium-25.0.7-0ubuntu0.24.04.1.so
=== VA-API PROBE (DRM path) ===
libva info: VA-API version 1.20.0
libva info: User environment variable requested driver 'iHD'
libva info: Trying to open /usr/lib/x86_64-linux-gnu/dri/iHD_drv_video.so
libva info: Found init function __vaDriverInit_1_20
libva error: /usr/lib/x86_64-linux-gnu/dri/iHD_drv_video.so init failed
libva info: va_openDriver() returns 1
vaInitialize failed with error code 1 (operation failed),exitRE: Jellyfin HW transcode (VA-API) on k3s keeps failing (Host issue?) - bitmap - 2025-08-30
Have you tried swapping to the hwe kernel? This doesn't appear to be an issue on that front, but could help driver-wise.
Your system report shows no card0, which could be the issue...passing /dev/dri should enable use of both card0 and renderD128. What's the output of:
Code:
lshw -c displayRequires super user perms.
RE: Jellyfin HW transcode (VA-API) on k3s keeps failing (Host issue?) - lilajka - 2025-08-30
Yeah im running on hwe kernel currently, but that doesn't help.
Code:
11:06:42 dano@asusnuc k3s_homelab ±|main✔|→ uname -r
6.14.0-29-generic
11:07:24 dano@asusnuc k3s_homelab ±|main✔|→ dpkg -l | grep linux-generic
ii linux-generic-hwe-24.04 6.14.0-29.29~24.04.1 amd64 Complete Generic Linux kernel and headersas for lshw output:
Code:
11:09:57 dano@asusnuc k3s_homelab ±|main✔|→ sudo lshw -c display
*-display
description: VGA compatible controller
product: Alder Lake-N [Intel Graphics]
vendor: Intel Corporation
physical id: 2
bus info: pci@0000:00:02.0
logical name: /dev/fb0
version: 00
width: 64 bits
clock: 33MHz
capabilities: pciexpress msi pm vga_controller bus_master cap_list rom fb
configuration: depth=32 driver=i915 latency=0 mode=1920x1080 resolution=1920,1080 visual=truecolor xres=1920 yres=1080
resources: iomemory:600-5ff iomemory:400-3ff irq:147 memory:60e7000000-60e7ffffff memory:4000000000-400fffffff ioport:4000(size=64) memory:c0000-dffff memory:60e0000000-60e6ffffff memory:6000000000-60dfffffffand also, this is from the container, if it helps (tried official image + linuxserver one)
Code:
root@jellyfin-dc7b969d-r4tbb:/# vainfo --display drm --device /dev/dri/renderD128
/usr/lib/jellyfin-ffmpeg/ffmpeg \ -init_hw_device vaapi=va:/dev/dri/renderD128 -filter_hw_device va \ -hwaccel vaapi -hwaccel_output_format vaapi \ -i "/data/Movies/South Park - Joining the Panderverse (2023)"/ -c:v h264_vaapi -f null -
Failed to open the given device!
ffmpeg version 7.1.1-Jellyfin Copyright (c) 2000-2025 the FFmpeg developers
built with gcc 13 (Ubuntu 13.3.0-6ubuntu2~24.04)
configuration: --prefix=/usr/lib/jellyfin-ffmpeg --target-os=linux --extra-version=Jellyfin --disable-doc --disable-ffplay --disable-static --disable-libxcb --disable-sdl2 --disable-xlib --enable-lto=auto --enable-gpl --enable-version3 --enable-shared --enable-gmp --enable-gnutls --enable-chromaprint --enable-opencl --enable-libdrm --enable-libxml2 --enable-libass --enable-libfreetype --enable-libfribidi --enable-libfontconfig --enable-libharfbuzz --enable-libbluray --enable-libmp3lame --enable-libopus --enable-libtheora --enable-libvorbis --enable-libopenmpt --enable-libdav1d --enable-libsvtav1 --enable-libwebp --enable-libvpx --enable-libx264 --enable-libx265 --enable-libzvbi --enable-libzimg --enable-libfdk-aac --arch=amd64 --enable-libshaderc --enable-libplacebo --enable-vulkan --enable-vaapi --enable-amf --enable-libvpl --enable-ffnvcodec --enable-cuda --enable-cuda-llvm --enable-cuvid --enable-nvdec --enable-nvenc
libavutil 59. 39.100 / 59. 39.100
libavcodec 61. 19.101 / 61. 19.101
libavformat 61. 7.100 / 61. 7.100
libavdevice 61. 3.100 / 61. 3.100
libavfilter 10. 4.100 / 10. 4.100
libswscale 8. 3.100 / 8. 3.100
libswresample 5. 3.100 / 5. 3.100
libpostproc 58. 3.100 / 58. 3.100
Invalid filter device va.
Failed to set value 'va' for option 'filter_hw_device': Invalid argument
Error parsing global options: Invalid argument
root@jellyfin-dc7b969d-r4tbb:/# vainfo
error: XDG_RUNTIME_DIR is invalid or not set in the environment.
error: can't connect to X server!
error: failed to initialize display
root@jellyfin-dc7b969d-r4tbb:/# vainfo --display drm --device /dev/dri/renderD128
Failed to open the given device!
root@jellyfin-dc7b969d-r4tbb:/# ll /dev/dri
total 0
drwxr-xr-x 3 root root 100 Aug 29 16:29 ./
drwxr-xr-x 6 root root 380 Aug 29 16:29 ../
drwxr-xr-x 2 root root 80 Aug 29 16:29 by-path/
crw-rw----+ 1 root video 226, 1 Aug 29 16:47 card1
crw-rw----+ 1 root videoaely 226, 128 Aug 29 16:29 renderD128RE: Jellyfin HW transcode (VA-API) on k3s keeps failing (Host issue?) - lilajka - 2025-08-30
I'm just dumb. Forgot about this:
https://dgpu-docs.intel.com/driver/client/overview.html
Then, for the pod I had to add few security contexts, because jellyfin couldn't access /dev/dri, even though it had permissions and supplementary groups added.
Code:
securityContext:
privileged: true
allowPrivilegeEscalation: true
readOnlyRootFilesystem: false
seccompProfile: { type: Unconfined }