<?xml version="1.0" encoding="utf-8"?>
<rss version="2.0"
    xmlns:content="http://purl.org/rss/1.0/modules/content/"
    xmlns:dc="http://purl.org/dc/elements/1.1/"
    xmlns:atom="http://www.w3.org/2005/Atom">
    <channel>
        <title>lxc — LowEndSpirit</title>
        <link>https://staging.lowendspirit.com/index.php?p=/</link>
        <pubDate>Fri, 10 Apr 2026 03:40:42 +0000</pubDate>
        <language>en</language>
            <description>lxc — LowEndSpirit</description>
    <atom:link href="https://staging.lowendspirit.com/index.php?p=/discussions/tagged/lxc/feed.rss" rel="self" type="application/rss+xml"/>
    <item>
        <title>Killer Core: KVM-3C - $21 Quarterly &amp; Windows-4G @ $10 Month - HostCram LLC i9-11900K in Dallas, TX</title>
        <link>https://staging.lowendspirit.com/index.php?p=/discussion/4290/killer-core-kvm-3c-21-quarterly-windows-4g-10-month-hostcram-llc-i9-11900k-in-dallas-tx</link>
        <pubDate>Fri, 24 Jun 2022 21:16:05 +0000</pubDate>
        <category>Offers</category>
        <dc:creator>Shakib</dc:creator>
        <guid isPermaLink="false">4290@/index.php?p=/discussions</guid>
        <description><![CDATA[<p><a rel="nofollow" href="https://www.hostcram.com" title="![]"><img src="https://talk.lowendspirit.com/uploads/editor/lx/v5waigcrsa63.png" alt="" title="" /></a></p>

<h2>We are <a rel="nofollow" href="https://www.hostcram.com" title="HostCram LLC">HostCram LLC</a>,</h2>

<p>a US based Wyoming registered company (<a rel="nofollow" href="https://wyobiz.wyo.gov/Business/FilingDetails.aspx?eFNum=153014087255104045146212210168127209107237105253" title="Filling ID: 2016-000736577">Filling ID: 2016-000736577</a>) posting our brand new Intel® Core™ i9-11900K,  Samsung 4.0 NVMe VPS Hosting deals offer on LowEndSpirit. <img src="https://staging.lowendspirit.com/plugins/emojiextender/emoji/twitter/blush.png" title=":3" alt=":3" height="18" /></p>

<p><strong>Our company registration can be <a rel="nofollow" href="https://wyobiz.wyo.gov/Business/FilingDetails.aspx?eFNum=153014087255104045146212210168127209107237105253" title="verified here">verified here</a>.</strong></p>

<p><em>We also provide <a rel="nofollow" href="https://www.hostcram.com/proxy" title="Private Proxy">Private Proxy</a>, <a rel="nofollow" href="https://www.hostcram.com/email" title="Email Servers">Email Servers</a>, <a rel="nofollow" href="https://www.hostcram.com/ip-rental" title="IP Rental &amp; ASN">IP Rental &amp; ASN</a> services. We are up on dozens of ISP, Business, Hosting networks, Servers with BGP Session &amp; IP Announcement available.</em></p>

<h2>Our VPS Hosting services includes:</h2>

<p>All new Dell Branded Hardware<br />
Intel® Core™ i9-11900K Processor<br />
Samsung 4.0 NVMe SSD Storage<br />
SK Hynix 3200 MHz DDR4 RAM<br />
1 Gbps (INAP) Bandwidth per node (10G total)<br />
Free /48 IPv6 Prefix on request<br />
Free Monthly Offsite Backups<br />
Cloud Portal Access<br />
Full Root Access</p>

<p><em>Yes. Those services will be deployed on brand new nodes, comes with Limited Support and self OS Rebuild, Start, Stop, Reboot, Console, etc. management options. Our existing nodes where we put clients with similar plans during last year's promotions are running fine for over 6 months. As there haven't been any related network downtime yet, we can say the uptime for those services has been 100% since the last reboot was made. (<a rel="nofollow" href="https://imgur.com/a/OVjR3uF" title="See this">See this</a>)</em></p>

<h2>Windows-4G (RDP+Proxmox access)</h2>

<p>2 vCPU Core (i9-11900K)<br />
4 GB DDR4 RAM (Dedicated)<br />
80 GB NVMe SSD Storage<br />
4 TB INAP Bandwidth @ 1 Gbps Port<br />
1 Dedicated IPv4</p>

<p>Windows Server 2019 64 bit - 180 days trial version by default. Bring your own license for other versions.</p>

<p><strong><a rel="nofollow" href="https://my.hostcram.com/order/main/packages/special-offers/?group_id=16&amp;pricing_id=716" title="Order now : $10 Month / $50 for 6 Months">Order now : $10 Month / $50 for 6 Months</a></strong></p>

<h2>Killer Core: KVM-3C (Linux &amp; Windows OS)</h2>

<p>3 vCPU Core (i9-11900K)<br />
3 GB DDR4 RAM (Dedicated)<br />
70 GB NVMe SSD Storage<br />
3 TB INAP Bandwidth @ 1 Gbps Port<br />
1 Dedicated IPv4</p>

<p><strong><a rel="nofollow" href="https://my.hostcram.com/order/main/packages/special-offers/?group_id=16&amp;pricing_id=665" title="Order now : $21 Quarterly / $84 Yearly (Recurring)">Order now : $21 Quarterly / $84 Yearly (Recurring)</a></strong><br />
<em>Very limited stock.</em></p>

<h2>VPS Promo: LXC-3G</h2>

<p>2 vCPU Core (i9-11900K)<br />
3 GB DDR4 RAM (3200 MHz)<br />
60 GB NVMe SSD Storage<br />
3 TB INAP Bandwidth @ 1 Gbps Port<br />
1 Dedicated IPv4</p>

<p><strong><a rel="nofollow" href="https://my.hostcram.com/order/main/packages/special-offers/?group_id=16&amp;pricing_id=708" title="Order now : $50 Year (Recurring)">Order now : $50 Year (Recurring)</a></strong></p>

<h2>VPS Promo: LXC-6G</h2>

<p>3 vCPU Core (i9-11900K)<br />
6 GB DDR4 RAM (3200 MHz)<br />
90 GB NVMe SSD Storage<br />
6 TB INAP Bandwidth @ 1 Gbps Port<br />
1 Dedicated IPv4</p>

<p><strong><a rel="nofollow" href="https://my.hostcram.com/order/main/packages/special-offers/?group_id=16&amp;pricing_id=710" title="Order now : $65 Year (Recurring)">Order now : $65 Year (Recurring)</a></strong></p>

<p>Our regular VPS plans can be found here: <a href="https://www.hostcram.com/vps" rel="nofollow">https://www.hostcram.com/vps</a></p>

<h2>Accepted primary payment methods:</h2>

<p>ACH, Debit/Credit Cards, PayPal, Payoneer, Cryptocurrency and 50+ Local Gateways from countries such as India, Indonesia (Ask for others)</p>

<h2>Refund Policy:</h2>

<p>Plans or services listed under this thread doesn't qualify for a refund. If you're unsure about something, ask us before buying. Don't buy if you want to do CPU mining. Don't buy if you want to use 100% of CPU 24/7. Those are not email servers. Contact us for buying email servers.</p>

<h2>Datacenter info:</h2>

<p>Carrier-1 Data Centers,<br />
1515 Round Table Dr, Dallas, TX 75247</p>

<h2>Network info:</h2>

<p>AS39618 - HostCram LLC<br />
Fully owned IP ranges and BGP network routed via Juniper router. Internap (INAP) is our primary transit. KVM-3C plan buyers will get IPs from our special IP range that has optimized Level3 &amp; HE routes &amp; bandwidth as well. You can ask us for test IP via live chat.</p>

<h2>Affiliate Signup:</h2>

<p>We pay 25% commissions for every order placed using your custom affiliate link by tracking visitors you refer to us using a cookie. The cookie will last up to 180 days following the initial visit, so you will get a commission for the referral even if they do not sign up immediately. If you have any questions, please contact us, or sign up by clicking the button below.</p>

<p><strong>Signup &gt; <a href="https://my.hostcram.com/order/main/index/register" rel="nofollow">https://my.hostcram.com/order/main/index/register</a></strong></p>

<p><strong>Limited stock available.</strong> Each order will be reviewed later. Use valid contact info only. All questions are answerable via <a rel="nofollow" href="https://my.hostcram.com/dashboard/plugin/support_manager/client_tickets/departments/" title="support ticket">support ticket</a> and <a rel="nofollow" href="https://www.hostcram.com/" title="live chat">live chat</a>. Don't forget to read our <a rel="nofollow" href="https://www.hostcram.com/tos" title="TOS">TOS</a>, <a rel="nofollow" href="https://www.hostcram.com/aup" title="AUP">AUP</a> &amp; <a rel="nofollow" href="https://www.hostcram.com/privacy-policy" title="Privacy Policy">Privacy Policy</a> before signing up. Thanks.  <img src="https://staging.lowendspirit.com/plugins/emojiextender/emoji/twitter/smile.png" title=":)" alt=":)" height="18" /></p>
]]>
        </description>
    </item>
    <item>
        <title>Fastest LXC &amp; KVM VPS with 5 Minute Setup and One Minute OS Rebuild - $2 First Month - HostCram LLC</title>
        <link>https://staging.lowendspirit.com/index.php?p=/discussion/4130/fastest-lxc-kvm-vps-with-5-minute-setup-and-one-minute-os-rebuild-2-first-month-hostcram-llc</link>
        <pubDate>Sun, 01 May 2022 18:24:16 +0000</pubDate>
        <category>Offers</category>
        <dc:creator>Shakib</dc:creator>
        <guid isPermaLink="false">4130@/index.php?p=/discussions</guid>
        <description><![CDATA[<p><a rel="nofollow" href="https://www.hostcram.com" title="![]"><img src="https://talk.lowendspirit.com/uploads/editor/lx/v5waigcrsa63.png" alt="" title="" /></a></p>

<h2>We are <a rel="nofollow" href="https://www.hostcram.com" title="HostCram LLC">HostCram LLC</a>,</h2>

<p>a US based Wyoming registered company (<a rel="nofollow" href="https://wyobiz.wyo.gov/Business/FilingDetails.aspx?eFNum=153014087255104045146212210168127209107237105253" title="Filling ID: 2016-000736577">Filling ID: 2016-000736577</a>) posting our brand new Intel® Core™ i9-11900K,  Samsung 4.0 NVMe VPS Hosting deals offer on LowEndSpirit. <img src="https://staging.lowendspirit.com/plugins/emojiextender/emoji/twitter/blush.png" title=":3" alt=":3" height="18" /></p>

<p><strong>Our company registration can be <a rel="nofollow" href="https://wyobiz.wyo.gov/Business/FilingDetails.aspx?eFNum=153014087255104045146212210168127209107237105253" title="verified here">verified here</a>.</strong></p>

<p><em>We also provide <a rel="nofollow" href="https://www.hostcram.com/proxy" title="Private Proxy">Private Proxy</a>, <a rel="nofollow" href="https://www.hostcram.com/email" title="Email Servers">Email Servers</a>, <a rel="nofollow" href="https://www.hostcram.com/ip-rental" title="IP Rental &amp; ASN">IP Rental &amp; ASN</a> services. We are up on dozens of ISP, Business, Hosting networks, Servers with BGP Session &amp; IP Announcement available.</em></p>

<h2>Our VPS Hosting services includes:</h2>

<p>All new Dell Branded Hardware<br />
Intel® Core™ i9-11900K Processor<br />
Samsung 4.0 NVMe SSD Storage<br />
SK Hynix 3200 MHz DDR4 RAM<br />
1 Gbps (INAP) Bandwidth per node (10G total)<br />
Free /48 IPv6 Prefix on request<br />
Free Monthly Offsite Backups<br />
Cloud Portal Access<br />
Full Root Access</p>

<p><em>Yes. Those services will be deployed on brand new nodes that we just added on last month, comes with Limited Support and self OS Rebuild, Start, Stop, Reboot, Console, etc. management options. Our existing nodes where we put clients with similar plans during last year's promotions are running fine for over 6 months. As there haven't been any related network downtime yet, we can say the uptime for those services has been 100% since the last reboot was made. (<a rel="nofollow" href="https://imgur.com/a/OVjR3uF" title="See this">See this</a>)</em></p>

<h2>KVM-2G (Tryout)</h2>

<p>1 vCPU Core (i9-11900K)<br />
2 GB DDR4 RAM (Dedicated)<br />
40 GB NVMe SSD Storage<br />
2 TB INAP Bandwidth @ 1Gbps Port<br />
1 Dedicated IPv4</p>

<p><strong><a rel="nofollow" href="https://my.hostcram.com/order/main/packages/kvm-vps-hosting/?group_id=18&amp;pricing_id=685&amp;coupon=Tryout" title="Order now : $2 First Month / Renews at $10 Month">Order now : $2 First Month / Renews at $10 Month</a></strong><br />
Coupon Code: <strong>Tryout</strong> (One use per person or household)<br />
Quantity: 10 Today &amp; 10 Tomorrow</p>

<h2>Something from me <a href="https://staging.lowendspirit.com/index.php?p=/profile/Shakib" rel="nofollow">@Shakib</a></h2>

<p>I will add one more quantity for every 10 comments made with "<code>I'd like to tryout</code>" as long as I can do it. I will giveaway 100% of the money collected by selling Tryout plan during this promotion to <a rel="nofollow" href="https://globalfundforchildren.org" title="Global Fund for Children">Global Fund for Children</a>. I will cover all gateway fees.</p>

<h2>Killer Core: KVM-3C (Linux &amp; Windows OS)</h2>

<p>3 vCPU Core (i9-11900K)<br />
3 GB DDR4 RAM (Dedicated)<br />
70 GB NVMe SSD Storage<br />
3 TB INAP Bandwidth @ 1 Gbps Port<br />
1 Dedicated IPv4</p>

<p><strong><a rel="nofollow" href="https://my.hostcram.com/order/main/packages/special-offers/?group_id=16&amp;pricing_id=665" title="Order now : $84 Year (Recurring)">Order now : $84 Year (Recurring)</a></strong><br />
<em>Very limited stock.</em></p>

<h2>VPS Promo: LXC-3G</h2>

<p>2 vCPU Core (i9-11900K)<br />
3 GB DDR4 RAM (3200 MHz)<br />
60 GB NVMe SSD Storage<br />
3 TB INAP Bandwidth @ 1 Gbps Port<br />
1 Dedicated IPv4</p>

<p><strong><a rel="nofollow" href="https://my.hostcram.com/order/main/packages/special-offers/?group_id=16&amp;pricing_id=708" title="Order now : $50 Year (Recurring)">Order now : $50 Year (Recurring)</a></strong></p>

<h2>VPS Promo: LXC-6G</h2>

<p>3 vCPU Core (i9-11900K)<br />
6 GB DDR4 RAM (3200 MHz)<br />
90 GB NVMe SSD Storage<br />
6 TB INAP Bandwidth @ 1 Gbps Port<br />
1 Dedicated IPv4</p>

<p><strong><a rel="nofollow" href="https://my.hostcram.com/order/main/packages/special-offers/?group_id=16&amp;pricing_id=710" title="Order now : $65 Year (Recurring)">Order now : $65 Year (Recurring)</a></strong></p>

<p>Our regular VPS plans can be found here: <a href="https://www.hostcram.com/vps" rel="nofollow">https://www.hostcram.com/vps</a></p>

<h2>Accepted primary payment methods:</h2>

<p>Debit/Credit Cards, PayPal, Payoneer and 50+ Local Gateways from countries such as India, Indonesia (Ask for others)</p>

<h2>Refund Policy:</h2>

<p>Plans or services listed under this thread doesn't qualify for a refund. If you're unsure about something, ask us before buying. Don't buy if you want to do CPU mining. Don't buy if you want to use 100% of CPU 24/7. Those are not email servers. Contact us for buying email servers.</p>

<h2>Datacenter info:</h2>

<p>Carrier-1 Data Centers,<br />
1515 Round Table Dr, Dallas, TX 75247</p>

<h2>Network info:</h2>

<p>AS39618 - HostCram LLC<br />
Fully owned IP ranges and BGP network routed via Juniper router. Internap (INAP) is our primary transit. KVM-3C plan buyers will get IPs from our special IP range that has optimized Level3 &amp; HE routes &amp; bandwidth as well. You can ask us for test IP via live chat.</p>

<h2>Affiliate Signup:</h2>

<p>We pay 25% commissions for every order placed using your custom affiliate link by tracking visitors you refer to us using a cookie. The cookie will last up to 180 days following the initial visit, so you will get a commission for the referral even if they do not sign up immediately. If you have any questions, please contact us, or sign up by clicking the button below.</p>

<p><strong>Signup &gt; <a href="https://my.hostcram.com/order/main/index/register" rel="nofollow">https://my.hostcram.com/order/main/index/register</a></strong></p>

<p><strong>Limited stock available.</strong> Each order will be reviewed later. Use valid contact info only. All questions are answerable via <a rel="nofollow" href="https://my.hostcram.com/dashboard/plugin/support_manager/client_tickets/departments/" title="support ticket">support ticket</a> and <a rel="nofollow" href="https://www.hostcram.com/" title="live chat">live chat</a>. Don't forget to read our <a rel="nofollow" href="https://www.hostcram.com/tos" title="TOS">TOS</a>, <a rel="nofollow" href="https://www.hostcram.com/aup" title="AUP">AUP</a> &amp; <a rel="nofollow" href="https://www.hostcram.com/privacy-policy" title="Privacy Policy">Privacy Policy</a> before signing up. Thanks.  <img src="https://staging.lowendspirit.com/plugins/emojiextender/emoji/twitter/smile.png" title=":)" alt=":)" height="18" /></p>
]]>
        </description>
    </item>
    <item>
        <title>Intel iGPU VAAPI in Unprivileged LXC 4.0 Container</title>
        <link>https://staging.lowendspirit.com/index.php?p=/discussion/3782/intel-igpu-vaapi-in-unprivileged-lxc-4-0-container</link>
        <pubDate>Wed, 16 Feb 2022 05:35:57 +0000</pubDate>
        <category>Technical</category>
        <dc:creator>yoursunny</dc:creator>
        <guid isPermaLink="false">3782@/index.php?p=/discussions</guid>
        <description><![CDATA[<blockquote><div>
  <p>This article is originally published on yoursunny.com blog <a href="https://yoursunny.com/t/2022/lxc-vaapi/" rel="nofollow">https://yoursunny.com/t/2022/lxc-vaapi/</a></p>
</div></blockquote>

<h2>Background</h2>

<p>I recently bought a DELL OptiPlex 7040 Micro desktop computer and wanted to operate it as a dedicated server.<br />
I installed Debian 11 on the computer, and placed it into the closet to be accessed over SSH only.<br />
To keep the host machine stable, I decide to run most workloads in <a rel="nofollow" href="https://wiki.debian.org/LXC">LXC</a> containers, which are said to be Fast-as-Metal.<br />
Since I <a rel="nofollow" href="https://yoursunny.com/t/2021/NDN-video-ndn6/">operate my own video streaming website</a>, I have an LXC container for encoding the videos.</p>

<p>The computer comes with an <a rel="nofollow" href="https://ark.intel.com/content/www/us/en/ark/products/88183/intel-core-i56500t-processor-6m-cache-up-to-3-10-ghz.html">Intel Core i5-6500T</a> processor.<br />
It has 4 hardware cores running at 2.50GHz frequency, and belongs to the Skylake family.<br />
FFmpeg is happily encoding my videos on this CPU.</p>

<p>As I read through the processor specification, I noticed this section:</p>

<ul>
<li><p>Processor Graphics: Intel&reg; HD Graphics 530</p>

<ul>
<li>Processor Graphics indicates graphics processing circuitry integrated into the processor, providing the graphics, compute, media, and display capabilities.</li>
</ul></li>
<li><p>Intel&reg; Quick Sync Video: Yes</p>

<ul>
<li>Intel&reg; Quick Sync Video delivers fast conversion of video for portable media players, online sharing, and video editing and authoring.</li>
</ul></li>
</ul>

<p>It seems that I have a GPU!<br />
Can I make use of this Intel GPU and accelerate video encoding workloads?</p>

<h2>Story</h2>

<blockquote><div>
  <p>If you just want the solution, skip to the <strong>TL;DR Steps to Enable VAAPI in LXC</strong> section at the end.</p>
</div></blockquote>

<h3>Testing VAAPI with Docker</h3>

<p>I read FFmpeg <a rel="nofollow" href="https://trac.ffmpeg.org/wiki/HWAccelIntro">HWAccelIntro</a> and <a rel="nofollow" href="https://trac.ffmpeg.org/wiki/Hardware/QuickSync">QuickSync</a> pages, and learned:</p>

<ul>
<li>FFmpeg supports hardware acceleration on various GPU brands including Intel, AMD, and NVIDIA.</li>
<li>Hardware encoders typically generate outputs of significantly lower quality than good software encoders, but are generally faster and do not use much CPU resource.</li>
<li><p>On Linux, FFmpeg may access Intel GPU through libmfx, OpenCL, or VAAPI.<br />
Among these, encoding is possible with libmfx or VAAPI.</p></li>
<li><p>Each generation Intel processors has different video encoding capabilities.<br />
For the Skylake family that I have, the integrated GPU can encode to H.264, MPEG-2, VP8, and H.265 formats.</p></li>
</ul>

<p>I decided to experiment with VAAPI, because it has the shortest name 🤪.<br />
I quickly found <a rel="nofollow" href="https://hub.docker.com/r/jrottenberg/ffmpeg">jrottenberg/ffmpeg</a> Docker image.<br />
Following the example commands on <a rel="nofollow" href="https://trac.ffmpeg.org/wiki/Hardware/VAAPI">FFmpeg VAAPI</a> page, I verified that my GPU can successfully encode videos to H264 format:</p>

<pre><code>docker run \
    --device /dev/dri \
    -v $(pwd):/data -w /data \
  jrottenberg/ffmpeg:4.1-vaapi \
    -loglevel info -stats \
    -vaapi_device /dev/dri/renderD128 \
    -i input.mov \
    -vf 'hwupload,scale_vaapi=w=640:h=480:format=nv12' \
    -preset ultrafast \
    -c:v h264_vaapi \
    -f mp4 output.mp4
</code></pre>

<h3>The renderD128 Device</h3>

<p>This above <code>docker run</code> command tells me that the <code>/dev/dri/renderD128</code> device is likely the key of getting Intel GPU to work in an LXC container.<br />
It is a character device with major number 226 and minor number 128.</p>

<pre><code>sunny@sunnyD:~$ ls -l /dev/dri
total 0
drwxr-xr-x 2 root root         80 Jan 22 11:04 by-path
crw-rw---- 1 root video  226,   0 Jan 22 11:04 card0
crw-rw---- 1 root render 226, 128 Jan 22 11:04 renderD128
</code></pre>

<p>Inside the container, this device does not exist.<br />
Naively, I tried <code>mknod</code>, but it returns an "operation not permitted" error:</p>

<pre><code>ubuntu@video:~$ ls -l /dev/dri
ls: cannot access '/dev/dri': No such file or directory

ubuntu@video:~$ sudo mkdir /dev/dri

ubuntu@video:~$ sudo mknod /dev/dri/renderD128 c 226 128
mknod: /dev/dri/renderD128: Operation not permitted
</code></pre>

<p>I searched for this problem over several weeks, found several articles regarding how to get <a rel="nofollow" href="https://forums.plex.tv/t/pms-installation-guide-when-using-a-proxmox-5-1-lxc-container/219728">Plex</a> or <a rel="nofollow" href="https://emby.media/community/index.php?/topic/49680-howto-vaapi-transcoding-inside-lxc-container/">Emby</a> media server to use VAAPI hardware encoding from LXC containers, but they are either using <a rel="nofollow" href="https://forum.proxmox.com/threads/lxc-no-permission-to-use-vaapi.91536/">Proxmox</a> or <a rel="nofollow" href="https://linuxcontainers.org/lxd/">LXD</a> (unavailable on Debian), both differ from the plain LXC that I'm trying to use.<br />
From these articles, I gathered enough hints on what's needed:</p>

<ul>
<li>LXC container cannot <code>mknod</code> arbitrary devices for security reasons.</li>
<li><p>To have a device inode in an LXC container, the container config must:</p>

<ul>
<li>grant permission with <code>lxc.cgroup.devices.allow</code> directive, and</li>
<li>mount the device with <code>lxc.mount.entry</code> directory.</li>
</ul></li>
<li><p>In addition to <code>ffmpeg</code>, it's necessary to install <code>vainfo i965-va-driver</code> packages (available on both Debian and Ubuntu).</p></li>
</ul>

<h3>nobody:nogroup</h3>

<p>With these configs in place, the device showed up in the container, but it does not work:</p>

<pre><code>ubuntu@video:~$ ls -l /dev/dri
total 0
crw-rw---- 1 nobody nogroup 226, 128 Jan 22 16:04 renderD128
ubuntu@video:~$ vainfo
error: can't connect to X server!
error: failed to initialize display
ubuntu@video:~$ sudo vainfo
error: XDG_RUNTIME_DIR not set in the environment.
error: can't connect to X server!
error: failed to initialize display
</code></pre>

<p>One suspicious thing is the <code>nobody:nogroup</code> owner on the renderD128 device.<br />
It differs from the <code>root:render</code> owner as seen on the host machine.<br />
Naively, I tried <code>chown</code>, but it returns an "invalid argument" error and has no effect:</p>

<pre><code>ubuntu@video:~$ sudo chown root:render /dev/dri/renderD128
chown: changing ownership of '/dev/dri/renderD128': Invalid argument

ubuntu@video:~$ ls -l /dev/dri
total 0
crw-rw---- 1 nobody nogroup 226, 128 Jan 22 16:04 renderD128
</code></pre>

<p><a rel="nofollow" href="https://www.reddit.com/r/Proxmox/comments/ii3u2c/comment/g36l72j/">A Reddit post</a> claims that running <code>chmod 0666 /dev/dri/renderD128</code> from the host machine would solve this problem.<br />
I gave it a try and it was indeed effective.<br />
However, I know this isn't a <em>proper</em> solution because you are not supposed to change permission on device inodes.<br />
So I continued searching.</p>

<h3>idmap</h3>

<p>The last piece of the puzzle lies in <a rel="nofollow" href="https://man7.org/linux/man-pages/man7/user_namespaces.7.html">user and group ID mappings</a>.<br />
In an unprivileged LXC container, user and group IDs are shifted, so that the root user (UID 0) inside the container would not gain root privilege on the host machine.<br />
<code>lxc.idmap</code> directive in the container config controls these mappings.<br />
In my container, the relevant config was:</p>

<pre><code># map container UID 0~65535 to host UID 100000~165535
lxc.idmap = u 0 100000 65536
# map container GID 0~65535 to host GID 100000~165535
lxc.idmap = g 0 100000 65536
</code></pre>

<p>Notably, the <code>root</code> user (UID 0) and <code>render</code> group (GID 107) on the host user aren't mapped to anything in the container.<br />
The kernel <a rel="nofollow" href="https://discuss.linuxcontainers.org/t/strange-nobody-nogroup-ownership-in-unprivileged-lxc/1705/2">uses 65534 to represent a UID/GID which is outside the container's map</a>.<br />
Hence, the renderD128 device, when mounted into the container, has owner UID and GID being 65534:</p>

<pre><code>ubuntu@video:~$ ls -ln /dev/dri
total 0
crw-rw---- 1 65534 65534 226, 128 Jan 22 16:04 renderD128
</code></pre>

<p>65534 is the UID of <code>nobody</code> and the GID of <code>nogroup</code>, which is why this device appears to be owned by <code>nobody:nogroup</code>.</p>

<p>To make the renderD128 owned by <code>render</code> group, the correct solution is mapping the <code>render</code> group inside the container to the <code>render</code> group on the host.<br />
This, in turn, requires two ingredients:</p>

<ul>
<li><a rel="nofollow" href="https://man7.org/linux/man-pages/man5/subgid.5.html"><code>/etc/subgid</code></a> must authorize the host user who starts the container to map the GID of the host's <code>render</code> group into child namespaces.</li>
<li>The container config should have an <code>lxc.idmap</code> directive that maps the GID of the container's <code>render</code> group to the GID of the host's <code>render</code> group.</li>
</ul>

<p>So I added <code>lxc:107:1</code> to <code>/etc/subgid</code>, in which <code>lxc</code> is the ordinary user on the host machine that starts the containers, and <code>107</code> is the GID of <code>render</code> group on the host machine.<br />
Then I modified the container config as:</p>

<pre><code># map container UID 0-65535 to host UID 100000-165535
lxc.idmap = u 0 100000 65536
# map container GID 0-65535 to host GID 100000-165535
lxc.idmap = g 0 100000 65536
# map container GID 109 to host GID 107
lxc.idmap = g 109 107 1
</code></pre>

<p>However, the container fails to start:</p>

<pre><code>lxc@sunnyD:~$ lxc-unpriv-start -F video
Running scope as unit: run-r611f1778b87645918a2255d44073b86b.scope
lxc-start: video: conf.c: lxc_map_ids: 2865 newgidmap failed to write mapping "newgidmap: write to gid_map failed: Invalid argument": newgidmap 5297 0 100000 65536 109 107 1
             lxc-start: video: start.c: lxc_spawn: 1726 Failed to set up id mapping.
</code></pre>

<p>Re-reading <a rel="nofollow" href="https://man7.org/linux/man-pages/man7/user_namespaces.7.html">user&#95;namespaces(7)</a> manpage reveals the reason:</p>

<blockquote><div>
  <p>Defining user and group ID mappings: writing to uid_map and gid_map</p>
  
  <ul>
  <li>The range of user IDs (group IDs) specified in each line cannot overlap with the ranges in any other lines.</li>
  </ul>
</div></blockquote>

<p>The above container config defines two group ID mappings that overlaps at the GID 109, which causes the failure.<br />
Instead, it must be split to three ranges: 0-108 mapped to 100000-100108, 109 mapped to 107, 110-65535 mapped to 100110-165535.</p>

<p>Another idea I had, changing the GID of the <code>render</code> group to a large number greater than 65535 and thus dodge the overlap, turns out to be a bad idea, as it causes an error during system upgrades:</p>

<pre><code>ubuntu@video:~$ sudo apt full-upgrade
Setting up udev (245.4-4ubuntu3.15) ...
The group `render' already exists and is not a system group. Exiting.
dpkg: error processing package udev (--configure):
 installed udev package post-installation script subprocess returned error exit status 1
</code></pre>

<p>Hence, I must carefully calculate the GID ranges and write three GID mapping entries.<br />
With this final piece in place, success!</p>

<pre><code>ubuntu@video:~$ vainfo 2&gt;/dev/null | head -10
vainfo: VA-API version: 1.7 (libva 2.6.0)
vainfo: Driver version: Intel i965 driver for Intel(R) Skylake - 2.4.0
vainfo: Supported profile and entrypoints
      VAProfileMPEG2Simple            : VAEntrypointVLD
      VAProfileMPEG2Simple            : VAEntrypointEncSlice
      VAProfileMPEG2Main              : VAEntrypointVLD
      VAProfileMPEG2Main              : VAEntrypointEncSlice
      VAProfileH264ConstrainedBaseline: VAEntrypointVLD
      VAProfileH264ConstrainedBaseline: VAEntrypointEncSlice
      VAProfileH264ConstrainedBaseline: VAEntrypointEncSliceLP
</code></pre>

<p>Encoding speed comparison on one of my videos:</p>

<ul>
<li><p>h264, ultrafast, 640x480 resolution</p></li>
<li><p>Intel GPU VAAPI encoding:</p>

<pre><code>frame= 2900 fps=201 q=-0.0 Lsize=   18208kB time=00:01:36.78 bitrate=1541.2kbits/s speed=6.71x
video:16583kB audio:1528kB subtitle:0kB other streams:0kB global headers:0kB muxing overhead: 0.533910%
</code></pre></li>
<li><p>Skylake CPU encoding:</p>

<pre><code>frame= 2900 fps=171 q=-1.0 Lsize=   18786kB time=00:01:36.78 bitrate=1590.1kbits/s speed=5.71x
video:17177kB audio:1528kB subtitle:0kB other streams:0kB global headers:0kB muxing overhead: 0.434900%
</code></pre></li>
<li><p>GPU encoding was 17.5% faster than CPU encoding.</p></li>
</ul>

<h2>TL;DR Steps to Enable VAAPI in LXC</h2>

<ol>
<li><p>Confirm that the <code>/dev/dri/renderD128</code> device exists on the host machine.</p>

<pre><code>lxc@sunnyD:~$ ls -l /dev/dri/renderD128
crw-rw---- 1 root render 226, 128 Jan 22 11:04 /dev/dri/renderD128
</code></pre>

<p>If the device does not exist, you do not have an Intel GPU or it is not recognized by the kernel.<br />
You must resolve this issue before proceeding to the next step.</p></li>
<li><p>Find the GID of the <code>render</code> group on the host machine:</p>

<pre><code>lxc@sunnyD:~$ getent group render
render:x:107:
</code></pre>

<p>On my computer, the GID is 107.</p></li>
<li><p>Authorize the host user who starts LXC containers to map the GID to child namespaces.</p>

<ol>
<li><p>Run <code>sudoedit /etc/subgid</code> to open the editor.</p></li>
<li><p>Append a line:</p>

<pre><code>lxc:107:1
</code></pre></li>
</ol>

<p>Explanation:</p>

<ul>
<li><code>lxc</code> refers to the host user account.</li>
<li><code>107</code> is the GID of the <code>render</code> group, as seen in step 2.</li>
<li><code>1</code> means authorizing just one GID.</li>
</ul></li>
<li><p>Create and start an LXC container, and find out the GID of the container's <code>render</code> group.<br />
I'm using a Ubuntu 20.04 template, but the same procedure is applicable to other templates.</p>

<pre><code>lxc@sunnyD:~$ export DOWNLOAD_KEYSERVER=keyserver.ubuntu.com

lxc@sunnyD:~$ lxc-create -n video -t download -- -d ubuntu -r focal -a amd64
Using image from local cache
Unpacking the rootfs

You just created an Ubuntu focal amd64 (20211228_07:42) container.

To enable SSH, run: apt install openssh-server
No default root or user password are set by LXC.

lxc@sunnyD:~$ lxc-unpriv-start video
Running scope as unit: run-re7a88541bd5d42ab92c9ea6d4cd2a19f.scope

lxc@sunnyD:~$ lxc-unpriv-attach video getent group render
Running scope as unit: run-reaad3e4a549a420bacb160fd8cbc87a8.scope
render:x:109:
</code></pre></li>
<li><p>Edit the container config.</p>

<ol>
<li><p>Run <code>editor ~/.local/share/lxc/video/config</code> to open the editor.</p></li>
<li><p>Delete existing lines that start with <code>lxc.idmap = g</code>.</p>

<p>However, do not delete lines that start with <code>lxc.idmap = u</code>.</p></li>
<li><p>Append these lines:</p>

<pre><code>lxc.idmap = g 0 100000 109
lxc.idmap = g 109 107 1
lxc.idmap = g 110 100110 65426
lxc.cgroup.devices.allow = c 226:128 rwm
lxc.mount.entry = /dev/dri/renderD128 dev/dri/renderD128 none bind,optional,create=file
</code></pre></li>
</ol>

<p>Explanation:</p>

<ul>
<li><p>The <code>lxc.idmap = g</code> directive defines a group ID mapping.</p>

<ul>
<li><code>109</code> is the GID of the container's <code>render</code> group, as seen instep 4.</li>
<li><code>107</code> is the GID of the host's <code>render</code> group, as seen in step 2.</li>
</ul></li>
<li><p>The <code>lxc.cgroup.devices.allow</code> directive exposes a device to the container.</p>

<ul>
<li><code>226:127</code> is the major number and minor number of the renderD128 device, as seen in step 1.</li>
</ul></li>
<li><p>The <code>lxc.mount.entry</code> directive mounts the host's renderD128 device into the container.</p></li>
</ul>

<p>You may use this handy idmap calculator to generate the <code>lxc.idmap</code> directives:<br />
(read original article <a href="https://yoursunny.com/t/2022/lxc-vaapi/" rel="nofollow">https://yoursunny.com/t/2022/lxc-vaapi/</a> to use the JavaScript calculator)</p></li>
<li><p>Restart the container and attach to its console.</p>

<pre><code>lxc@sunnyD:~$ lxc-stop video

lxc@sunnyD:~$ lxc-unpriv-start video
Running scope as unit: run-r77f46b8ba5b24254a99c1ef9cb6384c3.scope

lxc@sunnyD:~$ lxc-unpriv-attach video
Running scope as unit: run-r11cf863c81e74fcfa1615e89902b1284.scope
</code></pre></li>
<li><p>Install FFmpeg and VAAPI packages in the container.</p>

<pre><code>root@video:/# apt update

root@video:/# apt install --no-install-recommends ffmpeg vainfo i965-va-driver
0 upgraded, 148 newly installed, 0 to remove and 15 not upgraded.
Need to get 79.2 MB of archives.
After this operation, 583 MB of additional disk space will be used.
Do you want to continue? [Y/n]
</code></pre></li>
<li><p>Confirm that the <code>/dev/dri/renderD128</code> device exists in the container and is owned by <code>render</code> group.</p>

<pre><code>root@video:/# ls -l /dev/dri/renderD128
crw-rw---- 1 nobody render 226, 128 Jan 22 16:04 /dev/dri/renderD128
</code></pre>

<p>It's normal for the owner user to show as <code>nobody</code>.<br />
This does not affect operation as long as the calling user is a member of the <code>render</code> group.<br />
The only implication is that, the container's <code>root</code> user cannot access the renderD128 unless it is added to the <code>render</code> group.</p></li>
<li><p>Add container's user account(s) to <code>render</code> group.<br />
These users will have access to the GPU.</p>

<pre><code>root@video:/# /sbin/adduser ubuntu render
Adding user `ubuntu' to group `render' ...
Adding user ubuntu to group render
Done.
</code></pre></li>
<li><p>Become one of these users, and verify the Intel iGPU is operational in the LXC container.</p>

<pre><code>root@video:/# sudo -iu ubuntu

ubuntu@video:~$ vainfo
error: XDG_RUNTIME_DIR not set in the environment.
error: can't connect to X server!
libva info: VA-API version 1.7.0
libva info: Trying to open /usr/lib/x86_64-linux-gnu/dri/iHD_drv_video.so
libva info: va_openDriver() returns -1
libva info: Trying to open /usr/lib/x86_64-linux-gnu/dri/i965_drv_video.so
libva info: Found init function __vaDriverInit_1_6
libva info: va_openDriver() returns 0
vainfo: VA-API version: 1.7 (libva 2.6.0)
vainfo: Driver version: Intel i965 driver for Intel(R) Skylake - 2.4.0
vainfo: Supported profile and entrypoints
      VAProfileMPEG2Simple            : VAEntrypointVLD
      VAProfileMPEG2Simple            : VAEntrypointEncSlice
      VAProfileMPEG2Main              : VAEntrypointVLD
      VAProfileMPEG2Main              : VAEntrypointEncSlice
      VAProfileH264ConstrainedBaseline: VAEntrypointVLD
      VAProfileH264ConstrainedBaseline: VAEntrypointEncSlice
      VAProfileH264ConstrainedBaseline: VAEntrypointEncSliceLP
      VAProfileH264ConstrainedBaseline: VAEntrypointFEI
      VAProfileH264ConstrainedBaseline: VAEntrypointStats
      VAProfileH264Main               : VAEntrypointVLD
      VAProfileH264Main               : VAEntrypointEncSlice
      VAProfileH264Main               : VAEntrypointEncSliceLP
      VAProfileH264Main               : VAEntrypointFEI
      VAProfileH264Main               : VAEntrypointStats
      VAProfileH264High               : VAEntrypointVLD
      VAProfileH264High               : VAEntrypointEncSlice
      VAProfileH264High               : VAEntrypointEncSliceLP
      VAProfileH264High               : VAEntrypointFEI
      VAProfileH264High               : VAEntrypointStats
      VAProfileH264MultiviewHigh      : VAEntrypointVLD
      VAProfileH264MultiviewHigh      : VAEntrypointEncSlice
      VAProfileH264StereoHigh         : VAEntrypointVLD
      VAProfileH264StereoHigh         : VAEntrypointEncSlice
      VAProfileVC1Simple              : VAEntrypointVLD
      VAProfileVC1Main                : VAEntrypointVLD
      VAProfileVC1Advanced            : VAEntrypointVLD
      VAProfileNone                   : VAEntrypointVideoProc
      VAProfileJPEGBaseline           : VAEntrypointVLD
      VAProfileJPEGBaseline           : VAEntrypointEncPicture
      VAProfileVP8Version0_3          : VAEntrypointVLD
      VAProfileVP8Version0_3          : VAEntrypointEncSlice
      VAProfileHEVCMain               : VAEntrypointVLD
      VAProfileHEVCMain               : VAEntrypointEncSlice
</code></pre></li>
</ol>

<h2>Conclusion</h2>

<p>This article explores how to make use of Intel processor's integrated GPU in an unprivileged LXC 4.0 container, on Debian 11 bullseye host machine without Proxmox or LXD.<br />
The key points include mounting the renderD128 device into the container, configuring idmap for the <code>render</code> group, and verifying the setup with <code>vainfo</code> command.<br />
The result is an LXC container that can encode videos to H.264 and other formats in the GPU with Intel Quick Sync Video feature, which is 17.5% faster than CPU encoding.</p>
]]>
        </description>
    </item>
    <item>
        <title>KVM/LXC NAT IPv4 VPS, Dedicated Ryzen CPU?</title>
        <link>https://staging.lowendspirit.com/index.php?p=/discussion/2077/kvm-lxc-nat-ipv4-vps-dedicated-ryzen-cpu</link>
        <pubDate>Mon, 16 Nov 2020 15:53:11 +0000</pubDate>
        <category>General</category>
        <dc:creator>Abdullah</dc:creator>
        <guid isPermaLink="false">2077@/index.php?p=/discussions</guid>
        <description><![CDATA[<p>Hi,</p>

<p>Thinking if people will be interested in KVM/LXC NAT VPS. Most people already <a rel="nofollow" href="https://en.m.wikipedia.org/wiki/Network_address_translation">know what is NAT</a></p>

<p>NAT VPS basically an IPv6-primary VPS with additional shared IPv4 for compatibility. <br />
You can achieve almost all tasks on a NAT'ed IPv4 + you get dedicated IPv6 too.</p>

<p>These KVM/LXC NAT VPS will have included 99.9% uptime guarantee, ddos protection &amp; support etc.<br />
<br /></p>

<hr />

<p>In United Kingdom or Netherlands : -</p>

<blockquote><div>
  <p>1 vCPU E3 - 12xx v3 <a href="https://staging.lowendspirit.com/index.php?p=/profile/3" rel="nofollow">@3</a>.4+Ghz<br />
  1GB ram<br />
  20GB Ent. SSD disk RAID-1<br />
  750GB Bandwidth@1Gbps<br />
  1 NAT IPv4 + Ipv6 + http/s on port 80/443<br />
  for about £14/year. stackable</p>
</div></blockquote>

<p>.<br />
.</p>

<blockquote><div>
  <p>4 vCPU E3 - 12xx v3 <a href="https://staging.lowendspirit.com/index.php?p=/profile/3" rel="nofollow">@3</a>.4+Ghz<br />
  5GB ram<br />
  100GB Ent. SSD disk RAID-1<br />
  3TB Bandwidth@1Gbps<br />
  1 dedicated IPv4 + Ipv6 + http/s on port 80/443<br />
  About £70/yr. or £7.5/mo.</p>
</div></blockquote>

<hr />

<p><br /><br />
The Ryzen ones, <br />
In Finland : -</p>

<blockquote><div>
  <p>1 vCPU Ryzen 3xxx <a href="https://staging.lowendspirit.com/index.php?p=/profile/3" rel="nofollow">@3</a>.5+GHz<br />
  1GB ECC RAM<br />
  10GB NVMe SSD or 40GB HDD in RAID-1<br />
  1-2TB Bandwidth@1Gbps<br />
  1 NAT IPv4 + IPv6 + http/s on port 80/443<br />
  For about £12/year, stackable</p>
</div></blockquote>

<p>.<br />
.</p>

<blockquote><div>
  <p>4 vCPU Ryzen 3xxx <a href="https://staging.lowendspirit.com/index.php?p=/profile/3" rel="nofollow">@3</a>.5+GHz<br />
  6GB ECC RAM<br />
  60GB NVMe SSD or 160GB HDD in RAID-1<br />
  <strong>Unlimited transfer@1Gbps</strong><br />
  1 NAT IPv4 + IPv6 + http/s on port 80/443<br />
  For about £65/yr or £6.8/month</p>
</div></blockquote>

<p><br />All vcores on &amp; above 2GB ram plan are 25% dedicated &amp;100% burstable.</p>

<p>4 vcores can be traded for 1 dedicated core<br />
<br /><br />
Similar to <a href="https://staging.lowendspirit.com/index.php?p=/profile/AnthonySmith" rel="nofollow">@AnthonySmith</a> 's littlehappycloud earlier, except considering LXC for the performance advantages. (you do get 25% dedicated, 100% burstable vcores with LXC too)</p>

<p>What do you think? have you tried LXC yet,<br />
Will you give this LXC VM a try.. or do we strictly need a KVM?</p>

<p>Will will have a separate NAT KVM line with dedicated cores for Windows machines.</p>

<p>Please feel free to participate with any ideas/demands/questions/suggestions or if you just want to say hi ?️  <img src="https://staging.lowendspirit.com/plugins/emojiextender/emoji/twitter/smiley.png" title="=)" alt="=)" height="18" /> <br />
<br /></p>

<p>Regards,<br />
Abdullah</p>
]]>
        </description>
    </item>
    <item>
        <title>OpenVZ7 or LXC</title>
        <link>https://staging.lowendspirit.com/index.php?p=/discussion/1477/openvz7-or-lxc</link>
        <pubDate>Sun, 19 Jul 2020 16:03:56 +0000</pubDate>
        <category>General</category>
        <dc:creator>Abdullah</dc:creator>
        <guid isPermaLink="false">1477@/index.php?p=/discussions</guid>
        <description><![CDATA[<p>As the title says, I know there are plenty of such topics online, but those arr mostly old.  <img src="https://staging.lowendspirit.com/plugins/emojiextender/emoji/twitter/smile.png" title=":)" alt=":)" height="18" /></p>

<p>I believe lxc has very much evolved these years, with few people using it for production, so anything you can say about it, performance , resource-overhead etc.<br />
Maybe providers who do LXC can throw some light</p>

<p>Also, lets add a poll.</p>
]]>
        </description>
    </item>
    <item>
        <title>Why do majority of VPS providers don't offer LXC?</title>
        <link>https://staging.lowendspirit.com/index.php?p=/discussion/170/why-do-majority-of-vps-providers-dont-offer-lxc</link>
        <pubDate>Tue, 26 Nov 2019 20:33:09 +0000</pubDate>
        <category>General</category>
        <dc:creator>vpsgeek</dc:creator>
        <guid isPermaLink="false">170@/index.php?p=/discussions</guid>
        <description><![CDATA[<p>I keep reading that it is not production ready yet but what does it lack that it is considered unfit to be offered as replacement for OpenVZ?</p>
]]>
        </description>
    </item>
   </channel>
</rss>
