# /etc/udev/rules.d/99-comfyui-gpu-access.rules
#
# Why world-writable compute nodes: the comfyui container is spawned by a
# systemd user unit (comfyui.service, Type=oneshot). User-unit processes are
# spawned by the user manager with NO supplementary groups, so any spawn path
# through systemd loses `render`/`video` membership regardless of how the
# container is launched (keep-groups and named group_add both depend on the
# spawning process already holding the group — verified 2026-08-31: keep-groups
# preserved an empty group list under the user manager and /dev/kfd open still
# failed with EACCES). A mode that grants access to "everyone in this uid
# domain" is the only spawn-context-independent option short of running the
# stack rootful.
#
# Blast radius: any local process (every container here runs as the same uid
# domain) can already ptrace the GPU userspace through an existing holder's
# fd inheritance; on a private single-administrator home server this trades a
# capability gate that could never be held by the intended user anyway.
# Note the missing SUBSYSTEM= guard on the kfd line: misc-class devices have no
# subsystem for udev matching, so a SUBSYSTEM=="misc" guard never matches.
KERNEL=="kfd", MODE="0666"
KERNEL=="renderD*", SUBSYSTEM=="drm", MODE="0666"