error: failed to initialize display on rootless official Docker

[doubledown]

Hello All!

I've been struggling to configure Jellyfin to run on rootless docker with transcoding. My main issue is that I get the following error when I'm doing the official Configure With Linux Virtualization installation guide's validation step:

Code:

$ docker exec -it jellyfin /usr/lib/jellyfin-ffmpeg/vainfo
Trying display: drm
error: failed to initialize display

I'm running a fresh install of Debian, with rootless docker setup, using docker compose, docker having its own dedicated user called 'dockeruser'. I'm pasting every detail I can below.

Code:

$ cat /etc/os-release
PRETTY_NAME="Debian GNU/Linux 13 (trixie)"
NAME="Debian GNU/Linux"
VERSION_ID="13"
VERSION="13 (trixie)"
VERSION_CODENAME=trixie
DEBIAN_VERSION_FULL=13.4
ID=debian
HOME_URL="https://www.debian.org/"
SUPPORT_URL="https://www.debian.org/support"
BUG_REPORT_URL="https://bugs.debian.org/"

user/group in container:

Code:

$ docker exec -it jellyfin ls -l /dev/dri
total 0
crw-rw---- 1 nobody nogroup 226,  0 Apr  7 21:24 card0
crw-rw---- 1 nobody nogroup 226, 128 Apr  7 21:24 renderD128

Code:

$ uname -a
Linux asgard 6.12.74+deb13+1-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.12.74-2 (2026-03-08) x86_64 GNU/Linux

user/group on host:

Code:

$ ls -l /dev/dri
total 0
drwxr-xr-x 2 root root        80 Apr  7 23:24 by-path
crw-rw---- 1 root video  226,  0 Apr  7 23:24 card0
crw-rw---- 1 root render 226, 128 Apr  7 23:24 renderD128

My docker-compose.yml:

Code:

services:
  jellyfin:
    image: jellyfin/jellyfin:10.11.8
    container_name: jellyfin
    hostname: jellyfin
    group_add:
      - "992" # 'render' group for GPU acceleration
      - "44" # 'video' group for GPU acceleration
      - "996" # 'input' group for GPU acceleration
    networks:
      - media_net
      - infra_net
    ports:
      - 8096:8096  # http traffic
      - 8920:8920  # https traffic
      - 1900:1900  # service auto-discovery
      - 7359:7359  # service auto-discovery
    devices:
      - /dev/dri/card0:/dev/dri/card0
      - /dev/dri/renderD128:/dev/dri/renderD128
    volumes:
      - jellyfin-config:/config
      - /mnt/disk1/jellyfin-cache:/cache
      - /mnt/md0/media:/media:ro
    restart: 'unless-stopped'

dockeruser on host (docker's own dedicated user):

Code:

$ id
uid=1001(dockeruser) gid=1001(dockeruser) groups=1001(dockeruser),44(video),992(render)
$ groups
dockeruser video render

/etc/group on host

Code:

render:x:992:dockeruser
video:x:44:dockeruser
dockeruser:x:1001:

user/group on container:

Code:

$ docker exec -it jellyfin id
uid=1001 gid=65534(nogroup) groups=65534(nogroup),44(video),992,996
$ docker exec -it jellyfin groups
nogroup video groups: cannot find name for group ID 992
992 groups: cannot find name for group ID 996
996

on host

Code:

$ echo $DOCKER_HOST
unix:///run/user/1001/docker.sock

I have tried many things:

• I've added group_add to compose file to pass in the group for render and video
  
• I've tried to do 'user: 1001:1001' in compose file, no success
  
• tried to do 'user: 1001:992' and 'user: 1001:44', no success
  
• if I chmod 0666 card0 and renderD128, the vainfo works in the container but that's a bad practice
  

I've read on other places that it seems like people can run it in a rootless fashion.

I'm out of options at this point. What am I doing wrong?

Edit: Forgot to mention that I have an Intel CPU with iGPU.

Code:

$ cat /proc/cpuinfo | grep "model name" | head -1
model name : 12th Gen Intel(R) Core(TM) i5-12400