From 88dcd3cc0f1009c69b42e9f6b06102f37fd176ec Mon Sep 17 00:00:00 2001
From: Frank <frank@dankware>
Date: Wed, 19 Aug 2026 15:50:28 -0700
Subject: [PATCH] ComfyUI: rootless-correct GPU group config (video only)

Rootless podman cannot map the 'render' gid (990) into the container
namespace (dank's subgid range is 100000+), so --group-add render fails to
start the container. GPU access actually comes from the /dev/kfd + /dev/dri
passthrough, checked host-side (the run user is already in 'render' on the
host). So add only the 'video' group (which resolves) and drop 'render'.

Update the group test to assert video present and render ABSENT (with the
rootless rationale), per the approved rootless config.
---
 dankclaw/compose.yaml   |  5 +++--
 tests/comfyui_rocm.bats | 14 ++++++++++----
 2 files changed, 13 insertions(+), 6 deletions(-)

diff --git a/dankclaw/compose.yaml b/dankclaw/compose.yaml
index 11d2892..ef1c924 100644
--- a/dankclaw/compose.yaml
+++ b/dankclaw/compose.yaml
@@ -13,7 +13,9 @@ services:
 
   # --- AI image generation (ROCm GPU backend, gfx1151) ---------------------
   # Built from Containerfile.comfyui on AMD's gfx1151 torch base. The GPU is
-  # passed through (/dev/kfd, /dev/dri) with the video+render groups; no --cpu.
+  # reached via the /dev/kfd + /dev/dri passthrough (checked host-side; the run
+  # user is already in the render group). Only the 'video' group is added:
+  # rootless podman cannot map the render gid into the container namespace.
   # Models + data persist under /opt/comfyui. See ../docs/Dankclaw/ComfyUI.md.
   comfyui:
     build:
@@ -30,7 +32,6 @@ services:
       - /dev/dri:/dev/dri
     group_add:
       - video
-      - render
     volumes:
       - /opt/comfyui/models:/opt/ComfyUI/models
       - /opt/comfyui/input:/opt/ComfyUI/input
diff --git a/tests/comfyui_rocm.bats b/tests/comfyui_rocm.bats
index 62c3f7b..349537c 100644
--- a/tests/comfyui_rocm.bats
+++ b/tests/comfyui_rocm.bats
@@ -9,7 +9,8 @@
 #
 # STATUS (2026-08-19): the GPU migration is applied. The compose builds
 # comfyui-rocm:gfx1151 from Containerfile.comfyui (AMD's gfx1151 torch base),
-# passes /dev/kfd + /dev/dri, adds the video+render groups, and drops --cpu.
+# passes /dev/kfd + /dev/dri, adds the video group (render is unmappable in
+# rootless), and drops --cpu.
 # The four compose-wiring tests below are active (un-skipped). See
 # docs/Research/ComfyUI ROCm and Vulkan.md.
 
@@ -63,14 +64,19 @@ print("command OK:", cmd)
 PYEOF
 }
 
-@test "comfyui adds the video and render groups" {
+@test "comfyui adds the video group (render is unmappable in rootless)" {
     python3 - "$REPO_ROOT/dankclaw/compose.yaml" <<'PYEOF'
 import sys, yaml
 with open(sys.argv[1]) as fh:
     data = yaml.safe_load(fh)
 groups = data["services"]["comfyui"].get("group_add", [])
-for g in ("video", "render"):
-    assert g in groups, f"comfyui group_add must include {g}; got: {groups}"
+# 'video' is added (it resolves in the rootless namespace). 'render' (gid 990)
+# is intentionally ABSENT: rootless podman cannot map it into the container
+# namespace (the subgid range is 100000+), so --group-add render fails to start.
+# GPU access comes from the /dev/kfd + /dev/dri passthrough, checked host-side
+# (the run user is already a member of 'render' on the host).
+assert "video" in groups, f"comfyui group_add must include video; got: {groups}"
+assert "render" not in groups, f"comfyui group_add must NOT include render (unmappable in rootless); got: {groups}"
 print("groups OK:", groups)
 PYEOF
 }