SOLVED: Intel HEVC Transcoding

[Dreadhawk177]

I'm having trouble getting transcoding working for my intel nuc (Utra 5 CPU, should have pretty much every capability to encode/decode stuff), particularly with any HEVC format media transcoding into other formats for browsers that don't support HEVC. Here is the snippet at the end of the transcode log:

Code:

 
.....
Stream #0:36(spa): Subtitle: subrip (srt) (hearing impaired)
      Metadata:
        title          : Spanish (Latin America) (SDH)
        BPS            : 90
        DURATION        : 01:26:41.613000000
        NUMBER_OF_FRAMES: 1490
        NUMBER_OF_BYTES : 58622
        _STATISTICS_WRITING_APP: mkvmerge v88.0 ('All I Know') 64-bit
        _STATISTICS_WRITING_DATE_UTC: 2025-03-19 10:12:33
        _STATISTICS_TAGS: BPS DURATION NUMBER_OF_FRAMES NUMBER_OF_BYTES
[out#0/matroska @ 0x63f2767dd680] Error opening output /dev/dri/renderD128,driver=iHD: Permission denied
Error opening output file /dev/dri/renderD128,driver=iHD.
Error opening output files: Permission denied

I'm running the official jellyfin docker image on Ubuntu 24.04:

Code:

---
services:
  jellyfin:
    image: lscr.io/linuxserver/jellyfin:latest
    devices:
      - /dev/dri:/dev/dri
    #privileged: true
    group_add:
      - "992" # getent group render | cut -d: -f3
      - "44" # getent group video | cut -d: -f3
      - "995" # getent group input | cut -d: -f3
    container_name: jellyfin
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=Etc/UTC
      - JELLYFIN_PublishedServerUrl=192.168.0.116 #optional
      - DOCKER_MODS=linuxserver/mods:jellyfin-opencl-intel
    volumes:
      - /home/dreadserver/jellyfin/config:/config
      - /home/dreadserver/raid/data/:/data/
    ports:
      - 8096:8096
      - 8920:8920 #optional
      - 7359:7359/udp #optional
    restart: unless-stopped

I've tried running as privileged, no fix. Also went overkill with adding to groups.

Within the actual docker instance, the renderD128 seems good from my untrained eye. I don't know if it's looking for a file literally called 'renderD128,driver=iHD' though:

Code:

root@7511848ff80b:/# ls -al /dev/dri/
total 0
drwxr-xr-x 2 root root            60 Apr  5 16:36 .
drwxr-xr-x 6 root root          360 Apr  5 16:36 ..
crw-rw-rw- 1 root videoyo1z 226, 128 Apr  5 16:36 renderD128

This is a fairly fresh jellyfin instance, set up last night. Any thoughts or suggestions would be greatly appreciated. Couple of roadbumps, but otherwise Jellyfin rocks and my heart's out to the devs and community.

[TheDreadPirate]

For the record, you are using the LinuxServer jellyfin image, which is not official.

But that shouldn't be a problem.

Which Core Ultra model is in your NUC? I'm only seeing search results for Meteor Lake equipped NUCs. Which is what I assume your system has since renderD128 is visible. But confirm which model number it is.

And I don't think you need the entire group_add section for the LinuxServer image, so try removing it. IIRC, the container runs as root while Jellyfin inside runs as your user. Which means you don't need to do the group_add step.

[Dreadhawk177]

> For the record, you are using the LinuxServer jellyfin image, which is not official.
Woops, guess not. Good to know though.

Intel® Core™ Ultra 5 125H

I removed the group adds, as well as the privileged section. No change yet. Here's some output that might clarify as well:

Code:

docker exec -it jellyfin /usr/lib/jellyfin-ffmpeg/vainfo
Trying display: drm
libva info: VA-API version 1.22.0
libva info: Trying to open /usr/lib/jellyfin-ffmpeg/lib/dri/iHD_drv_video.so
libva info: Found init function __vaDriverInit_1_22
libva info: va_openDriver() returns 0
vainfo: VA-API version: 1.22 (libva 2.22.0)
vainfo: Driver version: Intel iHD driver for Intel(R) Gen Graphics - 25.1.0 (aa5ca48)
vainfo: Supported profile and entrypoints
      VAProfileNone                  : VAEntrypointVideoProc
      VAProfileMPEG2Simple            : VAEntrypointVLD
      VAProfileMPEG2Main              : VAEntrypointVLD
      VAProfileH264Main              : VAEntrypointVLD
      VAProfileH264Main              : VAEntrypointEncSlice
      VAProfileH264High              : VAEntrypointVLD
      VAProfileH264High              : VAEntrypointEncSlice
      VAProfileJPEGBaseline          : VAEntrypointVLD
      VAProfileJPEGBaseline          : VAEntrypointEncPicture
      VAProfileH264ConstrainedBaseline: VAEntrypointVLD
      VAProfileH264ConstrainedBaseline: VAEntrypointEncSlice
      VAProfileVP8Version0_3          : VAEntrypointVLD
      VAProfileHEVCMain              : VAEntrypointVLD
      VAProfileHEVCMain              : VAEntrypointEncSlice
      VAProfileHEVCMain10            : VAEntrypointVLD
      VAProfileHEVCMain10            : VAEntrypointEncSlice
      VAProfileVP9Profile0            : VAEntrypointVLD
      VAProfileVP9Profile0            : VAEntrypointEncSlice
      VAProfileVP9Profile1            : VAEntrypointVLD
      VAProfileVP9Profile1            : VAEntrypointEncSlice
      VAProfileVP9Profile2            : VAEntrypointVLD
      VAProfileVP9Profile2            : VAEntrypointEncSlice
      VAProfileVP9Profile3            : VAEntrypointVLD
      VAProfileVP9Profile3            : VAEntrypointEncSlice
      VAProfileHEVCMain12            : VAEntrypointVLD
      VAProfileHEVCMain422_10        : VAEntrypointVLD
      VAProfileHEVCMain422_12        : VAEntrypointVLD
      VAProfileHEVCMain444            : VAEntrypointVLD
      VAProfileHEVCMain444            : VAEntrypointEncSlice
      VAProfileHEVCMain444_10        : VAEntrypointVLD
      VAProfileHEVCMain444_10        : VAEntrypointEncSlice
      VAProfileHEVCMain444_12        : VAEntrypointVLD
      VAProfileHEVCSccMain            : VAEntrypointVLD
      VAProfileHEVCSccMain            : VAEntrypointEncSlice
      VAProfileHEVCSccMain10          : VAEntrypointVLD
      VAProfileHEVCSccMain10          : VAEntrypointEncSlice
      VAProfileHEVCSccMain444        : VAEntrypointVLD
      VAProfileHEVCSccMain444        : VAEntrypointEncSlice
      VAProfileAV1Profile0            : VAEntrypointVLD
      VAProfileAV1Profile0            : VAEntrypointEncSlice
      VAProfileHEVCSccMain444_10      : VAEntrypointVLD
      VAProfileHEVCSccMain444_10      : VAEntrypointEncSlice

lspci -nn | grep -Ei "3d|display|vga"
00:02.0 VGA compatible controller [0300]: Intel Corporation Meteor Lake-P [Intel Graphics] [8086:7dd5] (rev 08)
00:1c.5 PCI bridge [0604]: Intel Corporation Device [8086:7e3d] (rev 20)

Not sure if that's useful.

[TheDreadPirate]

Can you share the full ffmpeg log from your opening post?

And can you also run "ls -l /dev/dri" on the host and not in the container?

And also share the output of this command.

Code:

sudo dmesg | egrep "i915| xe "

[Dreadhawk177]

Attached is the full log of one of the transcode fails (seems consistently with going from HEVC to other formats).

And those two commands you wanted me to run:

Code:

dreadserver@dreadserver:/$ ls -l /dev/dri
total 0
drwxr-xr-x  2 root root        80 Apr  5 03:01 by-path
crw-rw-rw-+ 1 root video  226,  1 Apr  5 03:01 card1
crw-rw-rw-+ 1 root render 226, 128 Apr  5 03:01 renderD128


dreadserver@dreadserver:/$ sudo dmesg | egrep "i915| xe "
[  10.955475] Modules linked in: ccm rfcomm snd_seq_dummy snd_hrtimer overlay qrtr cmac algif_hash algif_skcipher af_alg bnep nft_chain_nat nft_limit xt_MASQUERADE nf_nat ipt_REJECT nf_reject_ipv4 xt_conntrack nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 xt_LOG nf_log_syslog xt_limit xt_addrtype xt_tcpudp nft_compat nf_tables binfmt_misc libcrc32c nls_iso8859_1 snd_soc_skl_hda_dsp snd_soc_hdac_hdmi snd_soc_intel_hda_dsp_common snd_sof_probes xe drm_gpuvm drm_exec gpu_sched drm_suballoc_helper drm_ttm_helper snd_hda_codec_hdmi snd_soc_rt711_sdca snd_hda_codec_conexant regmap_sdw_mbq snd_hda_codec_generic regmap_sdw snd_soc_dmic snd_sof_pci_intel_mtl snd_sof_intel_hda_generic soundwire_intel soundwire_cadence snd_sof_intel_hda_common snd_sof_intel_hda_mlink intel_uncore_frequency snd_sof_intel_hda intel_uncore_frequency_common snd_sof_pci x86_pkg_temp_thermal snd_sof_xtensa_dsp intel_powerclamp snd_sof coretemp snd_sof_utils snd_soc_hdac_hda snd_hda_ext_core snd_soc_acpi_intel_match kvm_intel soundwire_generic_allocation
[  10.955513]  snd_soc_acpi soundwire_bus snd_soc_core kvm snd_compress ac97_bus snd_pcm_dmaengine snd_hda_intel crct10dif_pclmul snd_intel_dspcfg polyval_clmulni rtw88_8821ce snd_intel_sdw_acpi polyval_generic rtw88_8821c snd_hda_codec ghash_clmulni_intel rtw88_pci sha256_ssse3 snd_hda_core sha1_ssse3 rtw88_core aesni_intel snd_hwdep crypto_simd i915 cryptd snd_pcm mac80211 snd_seq_midi snd_seq_midi_event cmdlinepart snd_rawmidi spi_nor btusb drm_buddy mtd mei_gsc_proxy intel_rapl_msr snd_seq ttm btrtl processor_thermal_device_pci cfg80211 snd_seq_device drm_display_helper processor_thermal_device btintel processor_thermal_wt_hint snd_timer processor_thermal_rfim btbcm cec rapl processor_thermal_rapl btmtk intel_rapl_common intel_cstate wmi_bmof libarc4 snd i2c_i801 mei_me bluetooth spi_intel_pci processor_thermal_wt_req i2c_mux rc_core processor_thermal_power_floor spi_intel soundcore mei i2c_smbus i2c_algo_bit intel_vpu processor_thermal_mbox intel_pmc_core igen6_edac joydev int3403_thermal int340x_thermal_zone
[  126.300651] Modules linked in: ccm rfcomm snd_seq_dummy snd_hrtimer overlay qrtr cmac algif_hash algif_skcipher af_alg bnep nft_chain_nat nft_limit xt_MASQUERADE nf_nat ipt_REJECT nf_reject_ipv4 xt_conntrack nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 xt_LOG nf_log_syslog xt_limit xt_addrtype xt_tcpudp nft_compat nf_tables binfmt_misc libcrc32c nls_iso8859_1 snd_soc_skl_hda_dsp snd_soc_hdac_hdmi snd_soc_intel_hda_dsp_common snd_sof_probes xe drm_gpuvm drm_exec gpu_sched drm_suballoc_helper drm_ttm_helper snd_hda_codec_hdmi snd_soc_rt711_sdca snd_hda_codec_conexant regmap_sdw_mbq snd_hda_codec_generic regmap_sdw snd_soc_dmic snd_sof_pci_intel_mtl snd_sof_intel_hda_generic soundwire_intel soundwire_cadence snd_sof_intel_hda_common snd_sof_intel_hda_mlink intel_uncore_frequency snd_sof_intel_hda intel_uncore_frequency_common snd_sof_pci x86_pkg_temp_thermal snd_sof_xtensa_dsp intel_powerclamp snd_sof coretemp snd_sof_utils snd_soc_hdac_hda snd_hda_ext_core snd_soc_acpi_intel_match kvm_intel soundwire_generic_allocation
[  126.300679]  snd_soc_acpi soundwire_bus snd_soc_core kvm snd_compress ac97_bus snd_pcm_dmaengine snd_hda_intel crct10dif_pclmul snd_intel_dspcfg polyval_clmulni rtw88_8821ce snd_intel_sdw_acpi polyval_generic rtw88_8821c snd_hda_codec ghash_clmulni_intel rtw88_pci sha256_ssse3 snd_hda_core sha1_ssse3 rtw88_core aesni_intel snd_hwdep crypto_simd i915 cryptd snd_pcm mac80211 snd_seq_midi snd_seq_midi_event cmdlinepart snd_rawmidi spi_nor btusb drm_buddy mtd mei_gsc_proxy intel_rapl_msr snd_seq ttm btrtl processor_thermal_device_pci cfg80211 snd_seq_device drm_display_helper processor_thermal_device btintel processor_thermal_wt_hint snd_timer processor_thermal_rfim btbcm cec rapl processor_thermal_rapl btmtk intel_rapl_common intel_cstate wmi_bmof libarc4 snd i2c_i801 mei_me bluetooth spi_intel_pci processor_thermal_wt_req i2c_mux rc_core processor_thermal_power_floor spi_intel soundcore mei i2c_smbus i2c_algo_bit intel_vpu processor_thermal_mbox intel_pmc_core igen6_edac joydev int3403_thermal int340x_thermal_zone
[  126.301809] Modules linked in: ccm rfcomm snd_seq_dummy snd_hrtimer overlay qrtr cmac algif_hash algif_skcipher af_alg bnep nft_chain_nat nft_limit xt_MASQUERADE nf_nat ipt_REJECT nf_reject_ipv4 xt_conntrack nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 xt_LOG nf_log_syslog xt_limit xt_addrtype xt_tcpudp nft_compat nf_tables binfmt_misc libcrc32c nls_iso8859_1 snd_soc_skl_hda_dsp snd_soc_hdac_hdmi snd_soc_intel_hda_dsp_common snd_sof_probes xe drm_gpuvm drm_exec gpu_sched drm_suballoc_helper drm_ttm_helper snd_hda_codec_hdmi snd_soc_rt711_sdca snd_hda_codec_conexant regmap_sdw_mbq snd_hda_codec_generic regmap_sdw snd_soc_dmic snd_sof_pci_intel_mtl snd_sof_intel_hda_generic soundwire_intel soundwire_cadence snd_sof_intel_hda_common snd_sof_intel_hda_mlink intel_uncore_frequency snd_sof_intel_hda intel_uncore_frequency_common snd_sof_pci x86_pkg_temp_thermal snd_sof_xtensa_dsp intel_powerclamp snd_sof coretemp snd_sof_utils snd_soc_hdac_hda snd_hda_ext_core snd_soc_acpi_intel_match kvm_intel soundwire_generic_allocation
[  126.301835]  snd_soc_acpi soundwire_bus snd_soc_core kvm snd_compress ac97_bus snd_pcm_dmaengine snd_hda_intel crct10dif_pclmul snd_intel_dspcfg polyval_clmulni rtw88_8821ce snd_intel_sdw_acpi polyval_generic rtw88_8821c snd_hda_codec ghash_clmulni_intel rtw88_pci sha256_ssse3 snd_hda_core sha1_ssse3 rtw88_core aesni_intel snd_hwdep crypto_simd i915 cryptd snd_pcm mac80211 snd_seq_midi snd_seq_midi_event cmdlinepart snd_rawmidi spi_nor btusb drm_buddy mtd mei_gsc_proxy intel_rapl_msr snd_seq ttm btrtl processor_thermal_device_pci cfg80211 snd_seq_device drm_display_helper processor_thermal_device btintel processor_thermal_wt_hint snd_timer processor_thermal_rfim btbcm cec rapl processor_thermal_rapl btmtk intel_rapl_common intel_cstate wmi_bmof libarc4 snd i2c_i801 mei_me bluetooth spi_intel_pci processor_thermal_wt_req i2c_mux rc_core processor_thermal_power_floor spi_intel soundcore mei i2c_smbus i2c_algo_bit intel_vpu processor_thermal_mbox intel_pmc_core igen6_edac joydev int3403_thermal int340x_thermal_zone

[TheDreadPirate]

Why is there an ACL on your render and card devices?

Code:

chris@rat-trap:/docker/containers$ ll /dev/dri
total 0
drwxr-xr-x  3 root root        100 Apr  1 14:30 ./
drwxr-xr-x 22 root root       5140 Apr  1 14:30 ../
drwxr-xr-x  2 root root         80 Apr  1 14:30 by-path/
crw-rw----  1 root video  226,   1 Apr  1 14:30 card1
crw-rw----  1 root render 226, 128 Apr  1 14:30 renderD128

You're using Docker directly on Ubuntu, correct? Without something like CasaOS or some other UI over top Ubuntu?

Code:

sudo setfacl -b -R /drv/dri

That will remove the ACLs.

[Dreadhawk177]

> Why is there an ACL on your render and card devices?
I didn't even know what an ACL was until you mentioned it. I would guess it has something to do with me using ZFS as a filesystem, but I'm definitely a super-noob in this area.

>You're using Docker directly on Ubuntu, correct? Without something like CasaOS or some other UI over top Ubuntu?
Yes, Ubuntu on bare metal, with Docker installed via these steps.

I ran the command you sent to remove the ACL, and tried again. Sorry to say that there's no change in behavior, still the same error. Just in case, I tried running the command when bashing into the docker container, but it didn't have setfacl installed/usable, so I assume that's not the way.

Thanks a ton for your help so far. If it keeps up, I can just wipe/reinstall Ubuntu and go through everything one more time, juuust in case I munched something on the host. Or try the official image instead of the linuxserver one. Super weird to me that vainfo and OpenCL commands run well. I wonder what makes HEVC different, this thing encodes/decodes AV1 perfectly.

[TheDreadPirate]

ZFS shouldn't make a difference since that "directory" doesn't exist on the file system like, for example, your home directory.

Can you try switching to the official image? In which case you WOULD need to need to use the group_add setting. You only need to pass in the render group, btw. You'd also use user: UID:GID instead of PUID and PGID in the environment section. My docker compose below as an example.

Code:

jellyfin-prod:
    image: ghcr.io/jellyfin/jellyfin:10.10.7
    container_name: jellyfin-prod
    hostname: jellyfin
    user: ${MEDIAUSER}:${MEDIAUSER}
    group_add:
      - '${RENDER}' # Stored in .env file.  ID 993 in my case
    networks:
      blackmoon:
        ipv4_address: 172.16.100.10
    expose:
      - 8096
    volumes:
      - ./jellyfin-prod-data/config:/config
      - ./jellyfin-prod-data/cache:/cache
      - /media/ramdisk:/media/ramdisk
      - /media/library:/media/library:ro
      - /media/library/liveTV:/media/library/liveTV:rw
    devices:
      - /dev/dri/renderD128:/dev/dri/renderD128
    environment:
      - TZ=${TZ}
    restart: unless-stopped

[Dreadhawk177]

After modifying the docker yaml to be the official image and making the corresponding changes, transcoding seems to be running properly! I really appreciate your help throughout this.
Got slightly paranoid about removing the groups just in case, but here's the latest yaml if anyone else wants it. Gonna call it a night and remove the jellyfin-opencl-intel mod and groups later, but this works really well!

Code:

---
services:
  jellyfin:
    image: ghcr.io/jellyfin/jellyfin:latest
    devices:
      - /dev/dri:/dev/dri
    #privileged: true
    group_add:
      - "992" # getent group render | cut -d: -f3
      - "44" # getent group video | cut -d: -f3
      - "995" # getent group input | cut -d: -f3
    container_name: jellyfin
    environment:
      - UID=1000
      - GID=1000
      - TZ=Etc/UTC
      - JELLYFIN_PublishedServerUrl=192.168.0.116 #optional
      - DOCKER_MODS=linuxserver/mods:jellyfin-opencl-intel
    volumes:
      - /home/dreadserver/jellyfin/config:/config
      - /home/dreadserver/raid/data/:/data/
    ports:
      - 8096:8096
      - 8920:8920 #optional
      - 7359:7359/udp #optional
    restart: unless-stopped

[TheDreadPirate]

Yes, remove the openCL mod. It doesn't work with our image. But our image does include Intel's openCL package already.