Frank
28eb7531e5
The comfyui container is spawned by a systemd user unit whose spawn context carries no supplementary groups, so render-group access to /dev/kfd and renderD128 was structurally unreachable (keep-groups preserved an empty set; named group_add 'render' fails name lookup inside the userns). World-mode on the compute nodes is the only spawn-context-independent grant; display cards keep their modes. Apply: install to /etc/udev/rules.d, udevadm control --reload-rules, then trigger by subsystem to re-apply modes to live nodes. Also maps dankclaw/udev/* in the focused-test selector (not bats-testable).
22 lines
1.2 KiB
Plaintext
22 lines
1.2 KiB
Plaintext
# /etc/udev/rules.d/99-comfyui-gpu-access.rules
|
|
#
|
|
# Why world-writable compute nodes: the comfyui container is spawned by a
|
|
# systemd user unit (comfyui.service, Type=oneshot). User-unit processes are
|
|
# spawned by the user manager with NO supplementary groups, so any spawn path
|
|
# through systemd loses `render`/`video` membership regardless of how the
|
|
# container is launched (keep-groups and named group_add both depend on the
|
|
# spawning process already holding the group — verified 2026-08-31: keep-groups
|
|
# preserved an empty group list under the user manager and /dev/kfd open still
|
|
# failed with EACCES). A mode that grants access to "everyone in this uid
|
|
# domain" is the only spawn-context-independent option short of running the
|
|
# stack rootful.
|
|
#
|
|
# Blast radius: any local process (every container here runs as the same uid
|
|
# domain) can already ptrace the GPU userspace through an existing holder's
|
|
# fd inheritance; on a private single-administrator home server this trades a
|
|
# capability gate that could never be held by the intended user anyway.
|
|
# Render nodes and /dev/kfd are compute nodes only — display outputs (card0,
|
|
# card1) keep their owner/group/mode.
|
|
KERNEL=="kfd", SUBSYSTEM=="misc", MODE="0666"
|
|
KERNEL=="renderD*", SUBSYSTEM=="drm", MODE="0666"
|