Hardware transcoding: go-vod don't work

System Information

Nextcloud version : 28.0.5
Operating system and version : Debian Linux 12
Apache or nginx version: Apache/2.4.59 (Debian)
PHP version: 8.2.18

I’m trying to get the video transcoding in the memories app working.
The go-vod is not working properly and I get the following Error:

I’ve installed the drivers and ffmpeg corresponding to this guide: Hardware Transcoding - Memories. Due to the Nextcloud installation is directly installed onto the server without docker, I followed the instructions in the chapter “Bare Metal”.

In the last step of the instruction the installation can be tested. Therefore it is tested if the go-vod and VA-API is set up correctly by transcoding an sample-video with the following command:

sudo -u www-data   ffmpeg -hwaccel vaapi -hwaccel_device /dev/dri/renderD128 -hwaccel_output_format vaapi   -i 'sample.mp4' -vcodec h264_vaapi   output-www-data2.mp4

If I try this, I get a “sample.mp4: Permission denied” Error.

Terminal Output "www-data"
ffmpeg version 5.1.4-0+deb12u1 Copyright (c) 2000-2023 the FFmpeg developers
  built with gcc 12 (Debian 12.2.0-14)
  configuration: --prefix=/usr --extra-version=0+deb12u1 --toolchain=hardened --libdir=/usr/lib/x86_64-linux-gnu --incdir=/usr/include/x86_64-linux-gnu --arch=amd64 --enable-gpl --disable-stripping --enable-gnutls --enable-ladspa --enable-libaom --enable-libass --enable-libbluray --enable-libbs2b --enable-libcaca --enable-libcdio --enable-libcodec2 --enable-libdav1d --enable-libflite --enable-libfontconfig --enable-libfreetype --enable-libfribidi --enable-libglslang --enable-libgme --enable-libgsm --enable-libjack --enable-libmp3lame --enable-libmysofa --enable-libopenjpeg --enable-libopenmpt --enable-libopus --enable-libpulse --enable-librabbitmq --enable-librist --enable-librubberband --enable-libshine --enable-libsnappy --enable-libsoxr --enable-libspeex --enable-libsrt --enable-libssh --enable-libsvtav1 --enable-libtheora --enable-libtwolame --enable-libvidstab --enable-libvorbis --enable-libvpx --enable-libwebp --enable-libx265 --enable-libxml2 --enable-libxvid --enable-libzimg --enable-libzmq --enable-libzvbi --enable-lv2 --enable-omx --enable-openal --enable-opencl --enable-opengl --enable-sdl2 --disable-sndio --enable-libjxl --enable-pocketsphinx --enable-librsvg --enable-libmfx --enable-libdc1394 --enable-libdrm --enable-libiec61883 --enable-chromaprint --enable-frei0r --enable-libx264 --enable-libplacebo --enable-librav1e --enable-shared
  libavutil      57. 28.100 / 57. 28.100
  libavcodec     59. 37.100 / 59. 37.100
  libavformat    59. 27.100 / 59. 27.100
  libavdevice    59.  7.100 / 59.  7.100
  libavfilter     8. 44.100 /  8. 44.100
  libswscale      6.  7.100 /  6.  7.100
  libswresample   4.  7.100 /  4.  7.100
  libpostproc    56.  6.100 / 56.  6.100
sample.mp4: Permission denied

If I call the command not from the www-data user but from root, the transcoding works as expected.

Terminal Output "sudo"

Command:

sudo ffmpeg -hwaccel vaapi -hwaccel_device /dev/dri/renderD128 -hwaccel_output_format vaapi   -i 'sample.mp4' -vcodec h264_vaapi   output-www-data.mp4

ffmpeg version 5.1.4-0+deb12u1 Copyright (c) 2000-2023 the FFmpeg developers
  built with gcc 12 (Debian 12.2.0-14)
  configuration: --prefix=/usr --extra-version=0+deb12u1 --toolchain=hardened --libdir=/usr/lib/x86_64-linux-gnu --incdir=/usr/include/x86_64-linux-gnu --arch=amd64 --enable-gpl --disable-stripping --enable-gnutls --enable-ladspa --enable-libaom --enable-libass --enable-libbluray --enable-libbs2b --enable-libcaca --enable-libcdio --enable-libcodec2 --enable-libdav1d --enable-libflite --enable-libfontconfig --enable-libfreetype --enable-libfribidi --enable-libglslang --enable-libgme --enable-libgsm --enable-libjack --enable-libmp3lame --enable-libmysofa --enable-libopenjpeg --enable-libopenmpt --enable-libopus --enable-libpulse --enable-librabbitmq --enable-librist --enable-librubberband --enable-libshine --enable-libsnappy --enable-libsoxr --enable-libspeex --enable-libsrt --enable-libssh --enable-libsvtav1 --enable-libtheora --enable-libtwolame --enable-libvidstab --enable-libvorbis --enable-libvpx --enable-libwebp --enable-libx265 --enable-libxml2 --enable-libxvid --enable-libzimg --enable-libzmq --enable-libzvbi --enable-lv2 --enable-omx --enable-openal --enable-opencl --enable-opengl --enable-sdl2 --disable-sndio --enable-libjxl --enable-pocketsphinx --enable-librsvg --enable-libmfx --enable-libdc1394 --enable-libdrm --enable-libiec61883 --enable-chromaprint --enable-frei0r --enable-libx264 --enable-libplacebo --enable-librav1e --enable-shared
  libavutil      57. 28.100 / 57. 28.100
  libavcodec     59. 37.100 / 59. 37.100
  libavformat    59. 27.100 / 59. 27.100
  libavdevice    59.  7.100 / 59.  7.100
  libavfilter     8. 44.100 /  8. 44.100
  libswscale      6.  7.100 /  6.  7.100
  libswresample   4.  7.100 /  4.  7.100
  libpostproc    56.  6.100 / 56.  6.100
Input #0, mov,mp4,m4a,3gp,3g2,mj2, from 'sample.mp4':
  Metadata:
    major_brand     : isom
    minor_version   : 512
    compatible_brands: isomiso2avc1mp41
  Duration: 00:00:10.00, start: 0.000000, bitrate: 837 kb/s
  Stream #0:0[0x1](und): Video: h264 (High) (avc1 / 0x31637661), yuv420p(progressive), 1920x1080 [SAR 1:1 DAR 16:9], 832 kb/s, 60 fps, 60 tbr, 15360 tbn (default)
    Metadata:
      handler_name    : VideoHandler
      vendor_id       : [0][0][0][0]
Stream mapping:
  Stream #0:0 -> #0:0 (h264 (native) -> h264 (h264_vaapi))
Press [q] to stop, [?] for help
[h264_vaapi @ 0x55cbd36bd940] No quality level set; using default (20).
Output #0, mp4, to 'output-www-data.mp4':
  Metadata:
    major_brand     : isom
    minor_version   : 512
    compatible_brands: isomiso2avc1mp41
    encoder         : Lavf59.27.100
  Stream #0:0(und): Video: h264 (High) (avc1 / 0x31637661), vaapi(progressive), 1920x1080 [SAR 1:1 DAR 16:9], q=2-31, 60 fps, 15360 tbn (default)
    Metadata:
      handler_name    : VideoHandler
      vendor_id       : [0][0][0][0]
      encoder         : Lavc59.37.100 h264_vaapi
frame=  171 fps=0.0 q=-0.0 size=    4096kB time=00:00:02.76 bitrate=12128.0kbits/s speed=5.41xframe=  344 fps=340 q=-0.0 size=    7424kB time=00:00:05.65 bitrate=10764.1kbits/s speed=5.58xframe=  517 fps=341 q=-0.0 size=   10752kB time=00:00:08.53 bitrate=10321.9kbits/s speed=5.63xframe=  600 fps=339 q=-0.0 Lsize=   12378kB time=00:00:09.96 bitrate=10173.9kbits/s speed=5.64x    
video:12371kB audio:0kB subtitle:0kB other streams:0kB global headers:0kB muxing overhead: 0.053069%

I already checked the and changed the file permissions for the “sample.mp4” but this doesn’t seem to be the problem.

-rwsrwsrwt 1 www-data www-data 1046987 Apr 30 19:20 sample.mp4

So my question is, if the go-vod error may be related to the fact that the transcoding/VA-API doesn’t work for the www-data user on my system.
And if so, does anyone have an idea why the test-transcoding only works when called from root and not when called from www-data user?

Thank you for your support!

What are the file ownership and permissions of /dev/dri/renderD128?

ls -ld /dev/dr/
ls -l /dev/dri/

Also, what are the group memberships of www-data:

id www-data

file ownership and permissions of /dev/dri/renderD128 are:

ls -ld /dev/dri/renderD128 
crw-rw-rw- 1 root render 226, 128 May 19 00:12 /dev/dri/renderD128

group memberships of www-data:

id www-data
uid=33(www-data) gid=33(www-data) groups=33(www-data),105(render),112(redis)