SOLVED: Jellyfin HW transcode (VA-API) on k3s keeps failing (Host issue?)

[lilajka]

Hello, I know this is probably issue on the host, not jellyfin itself, but Im having trouble with transcoding, or to better say with N150 graphics in general.

TL;DR: Jellyfin pod can see /dev/dri, but VA-API fails with Failed to open the given device! / No VA display found / iHD init failed. After lots of k8s/container tweaks, it looks like a host-side problem: on Ubuntu 24.04 my Asus NUC Essential 14 (N150) wouldn’t init.

---

Environment

• Host: Ubuntu 24.04 (Noble), originally 6.14.0-29-generic, fresh install
  
• Hardware: ASUS mini PC “asusnuc”, Intel N150 (Alder Lake-N), iGPU PCI ID shows as 8086:46d4; 2.5G Ethernet (exact model TBD — either Intel i225/i226 igc or Realtek RTL8125 r8125)
  
• nodeSelector: highperf: "true" (only this node has iGPU)
  
• Volumes: /config, /cache, media PVCs, and hostPath /dev/dri
  
• Security: supplementalGroups: [992, 44] (host render, video)
  
• Env: LIBVA_DRIVER_NAME=iHD
  
• Images tried: ghcr.io/jellyfin/jellyfin:latest and lscr.io/linuxserver/jellyfin
  

Goal: enable Quick Sync (VA-API) transcoding in Jellyfin on this node.

---

Symptoms

In the container

• vainfo --display drm --device /dev/dri/renderD128 → Failed to open the given device!
  
• Jellyfin’s FFmpeg with VA-API:No VA display found for device /dev/dri/renderD128. Device creation failed: -22.
  
• When -init_hw_device vaapi=va:... fails, -filter_hw_device va then errors with Invalid filter device va.
  

On the host

• vainfo --display drm --device /dev/dri/renderD128 prints:
  

Code:

libva info: VA-API version 1.20.0
libva info: User environment variable requested driver 'iHD'
libva info: Trying to open /usr/lib/x86_64-linux-gnu/dri/iHD_drv_video.so
libva info: Found init function __vaDriverInit_1_20
libva error: /usr/lib/x86_64-linux-gnu/dri/iHD_drv_video.so init failed
libva info: va_openDriver() returns 1
vaInitialize failed with error code 1 (operation failed),exit

Kernel logs show i915 loaded, DMC v2.20, GuC 70.36, HuC 7.9.3 → firmware looked fine.

---

What I tried (chronological highlights)
Kubernetes / container side

• Mounted /dev/dri into the pod (initially readOnly: true → changed to RW).
  
• Set supplementalGroups to host GIDs: render=992, video=44. Confirmed inside pod: id shows groups 992,44.
  
• Set LIBVA_DRIVER_NAME=iHD env in the container.
  
• (Temp) tried privileged: true, seccomp: Unconfined, AppArmor: Unconfined.
  
• Inside the Debian-based image, enabled non-free + non-free-firmware and installed:
  
• intel-media-va-driver-non-free, vainfo
  
• Verified iHD_drv_video.so exists; still failed to open VA display.
  
• Switched to linuxserver/jellyfin image (which normally handles /dev/dri perms for the abc user).
  

Host side (6.14)

• Ensured user is in render group; checked /dev/dri/renderD128 permissions (crw-rw---- root:render).
  
• Reinstalled userspace: intel-media-va-driver-non-free libva2 libdrm2 libigdgmm12 vainfo.
  
• Tried unloading xe (it wasn’t bound anyway).
  
• Tried kernel param i915.enable_pxp=0. Still iHD init failed.
  
• Connecting display to ASUS NUC & adding GRUB_CMDLINE_LINUX_DEFAULT="i915.enable_pxp=0 i915.modeset=1 i915.enable_guc=3 video=DP-1:1920x1080@60e quiet splash"
  

System report:

Code:

=== KERNEL & MODULES ===
6.14.0-29-generic
Driver (card0): no card0
Driver (renderD128): /sys/bus/pci/drivers/i915
Loaded modules:
xe                  3428352  0
drm_gpuvm              45056  1 xe
gpu_sched              61440  1 xe
drm_ttm_helper        16384  1 xe
drm_exec              12288  2 drm_gpuvm,xe
drm_suballoc_helper    20480  1 xe
i915                4714496  12
drm_buddy              24576  2 xe,i915
ttm                  118784  3 drm_ttm_helper,xe,i915
drm_display_helper    278528  2 xe,i915
cec                    94208  3 drm_display_helper,xe,i915
i2c_algo_bit          16384  2 xe,i915
intel_vsec            20480  2 intel_pmc_core,xe
video                  77824  4 asus_wmi,asus_nb_wmi,xe,i915
i915.ko present?
/lib/modules/6.14.0-29-generic/kernel/drivers/gpu/drm/i915/i915.ko.zst
filename:      /lib/modules/6.14.0-29-generic/kernel/drivers/gpu/drm/i915/i915.ko.zst
srcversion:    18AD0B385BA537B78D31B02
vermagic:      6.14.0-29-generic SMP preempt mod_unload modversions
parm:          invert_brightness:Invert backlight brightness (-1 force normal, 0 machine defaults, 1 force inversion), please report PCI device ID, subsystem vendor and subsystem device ID to dri-devel@lists.freedesktop.org, if your machine needs it. It will then be included in an upcoming module version. (int)

=== DRM DEVICES ===
total 0
drwxr-xr-x  2 root root        80 Aug 29 14:26 by-path
crw-rw----+ 1 root video  226,  1 Aug 29 14:33 card1
crw-rw----+ 1 root render 226, 128 Aug 29 14:26 renderD128

=== FIRMWARE (DMC/GuC/HuC) ===
Aug 29 14:26:39 asusnuc kernel: Command line: BOOT_IMAGE=/vmlinuz-6.14.0-29-generic root=UUID=2b302797-6909-4c5b-82fd-d1be03866ed5 ro i915.enable_pxp=0 quiet splash vt.handoff=7
Aug 29 14:26:39 asusnuc kernel: Kernel command line: BOOT_IMAGE=/vmlinuz-6.14.0-29-generic root=UUID=2b302797-6909-4c5b-82fd-d1be03866ed5 ro i915.enable_pxp=0 quiet splash vt.handoff=7
Aug 29 14:26:42 asusnuc kernel: i915: unknown parameter 'enable_pxp' ignored
Aug 29 14:26:42 asusnuc kernel: i915 0000:00:02.0: [drm] Found alderlake_p/alderlake_n (device ID 46d4) integrated display version 13.00 stepping D0
Aug 29 14:26:42 asusnuc kernel: i915 0000:00:02.0: [drm] VT-d active for gfx access
Aug 29 14:26:42 asusnuc kernel: i915 0000:00:02.0: vgaarb: deactivate vga console
Aug 29 14:26:42 asusnuc kernel: i915 0000:00:02.0: [drm] Using Transparent Hugepages
Aug 29 14:26:42 asusnuc kernel: i915 0000:00:02.0: vgaarb: VGA decodes changed: olddecodes=io+mem,decodes=io+mem:owns=io+mem
Aug 29 14:26:42 asusnuc kernel: i915 0000:00:02.0: [drm] Finished loading DMC firmware i915/adlp_dmc.bin (v2.20)
Aug 29 14:26:42 asusnuc kernel: i915 0000:00:02.0: [drm] GT0: GuC firmware i915/tgl_guc_70.bin version 70.36.0
Aug 29 14:26:42 asusnuc kernel: i915 0000:00:02.0: [drm] GT0: HuC firmware i915/tgl_huc.bin version 7.9.3
Aug 29 14:26:42 asusnuc kernel: i915 0000:00:02.0: [drm] GT0: HuC: authenticated for all workloads
Aug 29 14:26:42 asusnuc kernel: i915 0000:00:02.0: [drm] GT0: GUC: submission enabled
Aug 29 14:26:42 asusnuc kernel: i915 0000:00:02.0: [drm] GT0: GUC: SLPC enabled
Aug 29 14:26:42 asusnuc kernel: i915 0000:00:02.0: [drm] GT0: GUC: RC enabled
Aug 29 14:26:42 asusnuc kernel: mei_pxp 0000:00:16.0-fbf6fcf1-96cf-4e2e-a6a6-1bab8cbe36b1: bound 0000:00:02.0 (ops i915_pxp_tee_component_ops [i915])
Aug 29 14:26:42 asusnuc kernel: i915 0000:00:02.0: [drm] Protected Xe Path (PXP) protected content support initialized
Aug 29 14:26:42 asusnuc kernel: mei_hdcp 0000:00:16.0-b638ab7e-94e2-4ea2-a552-d1c54b627f04: bound 0000:00:02.0 (ops i915_hdcp_ops [i915])
Aug 29 14:26:42 asusnuc kernel: [drm] Initialized i915 1.6.0 for 0000:00:02.0 on minor 1
Aug 29 14:26:42 asusnuc kernel: fbcon: i915drmfb (fb0) is primary device
Aug 29 14:26:42 asusnuc kernel: i915 0000:00:02.0: [drm] fb0: i915drmfb frame buffer device
Aug 29 14:26:42 asusnuc kernel: snd_hda_intel 0000:00:1f.3: bound 0000:00:02.0 (ops i915_audio_component_bind_ops [i915])

=== USERS & PERMS ===
uid=1000(dano) gid=1000(dano) groups=1000(dano),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),100(users),114(lpadmin),992(render)
render:x:992:dano,jellyfin
User in render?
render

=== USERSPACE PACKAGES ===

WARNING: apt does not have a stable CLI interface. Use with caution in scripts.

intel-media-va-driver-non-free:
  Installed: 24.1.0+ds1-1
  Candidate: 24.1.0+ds1-1
  Version table:
*** 24.1.0+ds1-1 500
        500 http://archive.ubuntu.com/ubuntu noble/multiverse amd64 Packages
        100 /var/lib/dpkg/status
i965-va-driver:
  Installed: (none)
  Candidate: 2.4.1+dfsg1-1build2
  Version table:
    2.4.1+dfsg1-1build2 500
        500 http://archive.ubuntu.com/ubuntu noble/universe amd64 Packages
libva2:
  Installed: 2.20.0-2build1
  Candidate: 2.20.0-2build1
  Version table:
*** 2.20.0-2build1 500
        500 http://archive.ubuntu.com/ubuntu noble/universe amd64 Packages
        100 /var/lib/dpkg/status
libdrm2:
  Installed: 2.4.122-1~ubuntu0.24.04.1
  Candidate: 2.4.122-1~ubuntu0.24.04.1
  Version table:
*** 2.4.122-1~ubuntu0.24.04.1 500
        500 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 Packages
        100 /var/lib/dpkg/status
    2.4.120-2build1 500
        500 http://archive.ubuntu.com/ubuntu noble/main amd64 Packages
libigdgmm12:
  Installed: 22.3.17+ds1-1
  Candidate: 22.3.17+ds1-1
  Version table:
*** 22.3.17+ds1-1 500
        500 http://archive.ubuntu.com/ubuntu noble/universe amd64 Packages
        100 /var/lib/dpkg/status

=== VA-API DRIVERS ON DISK ===
lrwxrwxrwx 1 root root      40 May 23 17:16 /usr/lib/x86_64-linux-gnu/dri/d3d12_drv_video.so -> ../libgallium-25.0.7-0ubuntu0.24.04.1.so
-rw-r--r-- 1 root root 36102104 Dec 29  2023 /usr/lib/x86_64-linux-gnu/dri/iHD_drv_video.so
lrwxrwxrwx 1 root root      40 May 23 17:16 /usr/lib/x86_64-linux-gnu/dri/nouveau_drv_video.so -> ../libgallium-25.0.7-0ubuntu0.24.04.1.so
lrwxrwxrwx 1 root root      40 May 23 17:16 /usr/lib/x86_64-linux-gnu/dri/r600_drv_video.so -> ../libgallium-25.0.7-0ubuntu0.24.04.1.so
lrwxrwxrwx 1 root root      40 May 23 17:16 /usr/lib/x86_64-linux-gnu/dri/radeonsi_drv_video.so -> ../libgallium-25.0.7-0ubuntu0.24.04.1.so
lrwxrwxrwx 1 root root      40 May 23 17:16 /usr/lib/x86_64-linux-gnu/dri/virtio_gpu_drv_video.so -> ../libgallium-25.0.7-0ubuntu0.24.04.1.so

=== VA-API PROBE (DRM path) ===
libva info: VA-API version 1.20.0
libva info: User environment variable requested driver 'iHD'
libva info: Trying to open /usr/lib/x86_64-linux-gnu/dri/iHD_drv_video.so
libva info: Found init function __vaDriverInit_1_20
libva error: /usr/lib/x86_64-linux-gnu/dri/iHD_drv_video.so init failed
libva info: va_openDriver() returns 1
vaInitialize failed with error code 1 (operation failed),exit

[bitmap]

Have you tried swapping to the hwe kernel? This doesn't appear to be an issue on that front, but could help driver-wise.

Your system report shows no card0, which could be the issue...passing /dev/dri should enable use of both card0 and renderD128. What's the output of:

Code:

lshw -c display

Requires super user perms.

[lilajka]

Yeah im running on hwe kernel currently, but that doesn't help.

Code:

11:06:42 dano@asusnuc k3s_homelab ±|main✔|→ uname -r
6.14.0-29-generic
11:07:24 dano@asusnuc k3s_homelab ±|main✔|→ dpkg -l | grep linux-generic
ii  linux-generic-hwe-24.04                      6.14.0-29.29~24.04.1                    amd64        Complete Generic Linux kernel and headers

as for lshw output:

Code:

11:09:57 dano@asusnuc k3s_homelab ±|main✔|→ sudo lshw -c display
  *-display               
      description: VGA compatible controller
      product: Alder Lake-N [Intel Graphics]
      vendor: Intel Corporation
      physical id: 2
      bus info: pci@0000:00:02.0
      logical name: /dev/fb0
      version: 00
      width: 64 bits
      clock: 33MHz
      capabilities: pciexpress msi pm vga_controller bus_master cap_list rom fb
      configuration: depth=32 driver=i915 latency=0 mode=1920x1080 resolution=1920,1080 visual=truecolor xres=1920 yres=1080
      resources: iomemory:600-5ff iomemory:400-3ff irq:147 memory:60e7000000-60e7ffffff memory:4000000000-400fffffff ioport:4000(size=64) memory:c0000-dffff memory:60e0000000-60e6ffffff memory:6000000000-60dfffffff

and also, this is from the container, if it helps (tried official image + linuxserver one)

Code:

root@jellyfin-dc7b969d-r4tbb:/# vainfo --display drm --device /dev/dri/renderD128
/usr/lib/jellyfin-ffmpeg/ffmpeg \ -init_hw_device vaapi=va:/dev/dri/renderD128 -filter_hw_device va \ -hwaccel vaapi -hwaccel_output_format vaapi \ -i "/data/Movies/South Park - Joining the Panderverse (2023)"/ -c:v h264_vaapi -f null -
Failed to open the given device!
ffmpeg version 7.1.1-Jellyfin Copyright (c) 2000-2025 the FFmpeg developers
  built with gcc 13 (Ubuntu 13.3.0-6ubuntu2~24.04)
  configuration: --prefix=/usr/lib/jellyfin-ffmpeg --target-os=linux --extra-version=Jellyfin --disable-doc --disable-ffplay --disable-static --disable-libxcb --disable-sdl2 --disable-xlib --enable-lto=auto --enable-gpl --enable-version3 --enable-shared --enable-gmp --enable-gnutls --enable-chromaprint --enable-opencl --enable-libdrm --enable-libxml2 --enable-libass --enable-libfreetype --enable-libfribidi --enable-libfontconfig --enable-libharfbuzz --enable-libbluray --enable-libmp3lame --enable-libopus --enable-libtheora --enable-libvorbis --enable-libopenmpt --enable-libdav1d --enable-libsvtav1 --enable-libwebp --enable-libvpx --enable-libx264 --enable-libx265 --enable-libzvbi --enable-libzimg --enable-libfdk-aac --arch=amd64 --enable-libshaderc --enable-libplacebo --enable-vulkan --enable-vaapi --enable-amf --enable-libvpl --enable-ffnvcodec --enable-cuda --enable-cuda-llvm --enable-cuvid --enable-nvdec --enable-nvenc
  libavutil      59. 39.100 / 59. 39.100
  libavcodec    61. 19.101 / 61. 19.101
  libavformat    61.  7.100 / 61.  7.100
  libavdevice    61.  3.100 / 61.  3.100
  libavfilter    10.  4.100 / 10.  4.100
  libswscale      8.  3.100 /  8.  3.100
  libswresample  5.  3.100 /  5.  3.100
  libpostproc    58.  3.100 / 58.  3.100
Invalid filter device va.
Failed to set value 'va' for option 'filter_hw_device': Invalid argument
Error parsing global options: Invalid argument
root@jellyfin-dc7b969d-r4tbb:/# vainfo
error: XDG_RUNTIME_DIR is invalid or not set in the environment.
error: can't connect to X server!
error: failed to initialize display
root@jellyfin-dc7b969d-r4tbb:/# vainfo --display drm --device /dev/dri/renderD128
Failed to open the given device!
root@jellyfin-dc7b969d-r4tbb:/# ll /dev/dri
total 0
drwxr-xr-x  3 root root          100 Aug 29 16:29 ./
drwxr-xr-x  6 root root          380 Aug 29 16:29 ../
drwxr-xr-x  2 root root            80 Aug 29 16:29 by-path/
crw-rw----+ 1 root video    226,  1 Aug 29 16:47 card1
crw-rw----+ 1 root videoaely 226, 128 Aug 29 16:29 renderD128

[lilajka]

I'm just dumb. Forgot about this:
https://dgpu-docs.intel.com/driver/client/overview.html

Then, for the pod I had to add few security contexts, because jellyfin couldn't access /dev/dri, even though it had permissions and supplementary groups added.

Code:

securityContext:
            privileged: true
            allowPrivilegeEscalation: true
            readOnlyRootFilesystem: false
            seccompProfile: { type: Unconfined }

Now it works, thanks!