[GH-ISSUE #2447] mpv: nvdec HW decoder cannot load even with --noprofile

gitea-mirror commented

2026-05-05 08:16:28 -06:00

Owner

Originally created by @Ryujinra on GitHub (Feb 23, 2019).
Original GitHub issue: https://github.com/netblue30/firejail/issues/2447

mpv is unable to access the nvdec decoder even with --noprofile.

Steps to reproduce (must have an nvidia GPU):

firejail --noprofile mpv -hwdec=nvdec {SOMEVIDEOFILE}

mpv error:

[vo/gpu/cuda-nvdec] cu->cuInit(0) failed -> CUDA_ERROR_UNKNOWN: unknown error

Expected behavior: mpv loads with the VO decoder listed as [nv12] in stdout.

Does not work with the mpv.profile loaded either, obviously.

Tested on Arch w/ nvidia-vulkan-dkms driver version 418.31.03. mpv version mpv 0.29.0-134-g8b563a0346 (latest build from git).

Originally created by @Ryujinra on GitHub (Feb 23, 2019). Original GitHub issue: https://github.com/netblue30/firejail/issues/2447 mpv is unable to access the nvdec decoder even with --noprofile. Steps to reproduce (must have an nvidia GPU): `firejail --noprofile mpv -hwdec=nvdec {SOMEVIDEOFILE}` mpv error: `[vo/gpu/cuda-nvdec] cu->cuInit(0) failed -> CUDA_ERROR_UNKNOWN: unknown error` Expected behavior: mpv loads with the VO decoder listed as [nv12] in stdout. Does not work with the mpv.profile loaded either, obviously. Tested on Arch w/ nvidia-vulkan-dkms driver version 418.31.03. mpv version mpv 0.29.0-134-g8b563a0346 (latest build from git).

gitea-mirror

2026-05-05 08:16:28 -06:00

closed this issue
added the
graphics

stale

needinfo
labels

gitea-mirror commented

2026-05-05 08:16:32 -06:00

Author

Owner

@ghost commented on GitHub (Feb 23, 2019):

I don't have an NVIDIA GPU, so this is all speculation. Some remarks/questions. I do notice you have a single - in your command for mpv's --hwdec flag. Assuming this is a typo and not your actual command, a firejailed ffmpeg might be causing breakage here, even when running mpv with --noprofile. As I understand things, nvdec uses FFmpeg decoders (see the online mpv manual). Try taking out /etc/firejail/ffmpeg.profile temporarily to rule out any interference, or add ffmpeg commands to the mpv private-bin option. Does it work when also specifying --vo=gpu on the commandline, as is required for --hwdec=nvdec? Does it work with other hwdec/vo options for mpv, e.g. vdpau (which by the way is still a very able hardware decoding combo I do use personally)? Rather difficult to debug this without any logs.

Commands you might try:
$ firejail --debug --noprofile mpv --vo=gpu --hwdec=nvdec {SOMEVIDEOFILE} | tee my-debug.log 2>&1
$ firejail --debug --private-bin=ffmpeg,ffprobe,qt-faststart mpv --vo=gpu --hwdec=nvdec {SOMEVIDEOFILE} | tee my-other-debug.log 2>&1
$ firejail --debug --private-bin=ffmpeg,ffprobe,qt-faststart mpv --vo=vdpau --hwdec=vdpau {SOMEVIDEOFILE} | tee yet-another-debug.log 2>&1

@ghost commented on GitHub (Feb 23, 2019): I don't have an NVIDIA GPU, so this is all speculation. Some remarks/questions. I do notice you have a single `-` in your command for mpv's `--`hwdec flag. Assuming this is a typo and not your actual command, a `firejailed` `ffmpeg` might be causing breakage here, even when running mpv with --noprofile. As I understand things, nvdec uses FFmpeg decoders (see the [online mpv manual](https://mpv.io/manual/master/#options-hwdec)). Try taking out /etc/firejail/ffmpeg.profile temporarily to rule out any interference, or add ffmpeg commands to the mpv private-bin option. Does it work when also specifying --vo=gpu on the commandline, as is required for --hwdec=nvdec? Does it work with other hwdec/vo options for mpv, e.g. vdpau (which by the way is still a very able hardware decoding combo I do use personally)? Rather difficult to debug this without any logs. Commands you might try: $ firejail --debug --noprofile mpv --vo=gpu --hwdec=nvdec {SOMEVIDEOFILE} | tee my-debug.log 2>&1 $ firejail --debug --private-bin=ffmpeg,ffprobe,qt-faststart mpv --vo=gpu --hwdec=nvdec {SOMEVIDEOFILE} | tee my-other-debug.log 2>&1 $ firejail --debug --private-bin=ffmpeg,ffprobe,qt-faststart mpv --vo=vdpau --hwdec=vdpau {SOMEVIDEOFILE} | tee yet-another-debug.log 2>&1

gitea-mirror commented

2026-05-05 08:16:33 -06:00

Author

Owner

@Ryujinra commented on GitHub (Feb 23, 2019):

Does NOT work:

-Moving out ffmpeg.profile
-Adding vo=gpu (this vo was already selected automatically anyway)

DOES work:

-vdpau acceleration works as expected; however, nvdec does work without firejail and supposedly supercedes vdpau so I would like to get to the bottom of this if possible.

-A very strange thing I've noticed is that if I run mpv without firejail once, it will work with firejail (and even with the mpv.profile) until I reboot. Then it can't use the nvdec decoder until I run mpv without firejail again. So it seems that some file has to be created that enables access to the nvdec cuda decoder, and which is currently read-only for firejail and only survives until reboot. Maybe something in /tmp/ ?

Is there any way for me to disable or bisect the built-in firejail settings (the stuff beyond --noprofile)? I will post the requested logs soon. Thanks for the suggestions.

@Ryujinra commented on GitHub (Feb 23, 2019): Does NOT work: -Moving out ffmpeg.profile -Adding vo=gpu (this vo was already selected automatically anyway) DOES work: -vdpau acceleration works as expected; however, nvdec does work without firejail and supposedly supercedes vdpau so I would like to get to the bottom of this if possible. **-A very strange thing I've noticed is that if I run mpv without firejail once, it will work with firejail (and even with the mpv.profile) until I reboot. Then it can't use the nvdec decoder until I run mpv without firejail again. So it seems that some file has to be created that enables access to the nvdec cuda decoder, and which is currently read-only for firejail and only survives until reboot. Maybe something in /tmp/ ?** Is there any way for me to disable or bisect the built-in firejail settings (the stuff beyond --noprofile)? I will post the requested logs soon. Thanks for the suggestions.

gitea-mirror commented

2026-05-05 08:16:34 -06:00

Author

Owner

@ghost commented on GitHub (Feb 23, 2019):

Correct, nvdec supersedes VDPAU, allthough the latter is still supported by NVIDIA (and mesa). I do understand you wanting to use nvdec. Hopefully other people chime in to look at your logs, I will be offline for the weekend. Besides the debug options mentioned in man firejail there's nothing I'm aware OTOH. I'll look at your logs the first chance I get, this being a rather interesting issue. Sooner or later my oldie laptop will grind to a halt and mpv + nvdec would be a combination I'd want to get firejailed too.

Happy hunting

@ghost commented on GitHub (Feb 23, 2019): Correct, nvdec supersedes VDPAU, allthough the latter is still supported by NVIDIA (and mesa). I do understand you wanting to use nvdec. Hopefully other people chime in to look at your logs, I will be offline for the weekend. Besides the debug options mentioned in man firejail there's nothing I'm aware OTOH. I'll look at your logs the first chance I get, this being a rather interesting issue. Sooner or later my oldie laptop will grind to a halt and mpv + nvdec would be a combination I'd want to get firejailed too. Happy hunting

gitea-mirror commented

2026-05-05 08:16:35 -06:00

Author

Owner

@ghost commented on GitHub (Feb 24, 2019):

-A very strange thing I've noticed is that if I run mpv without firejail once, it will work with firejail (and even with the mpv.profile) until I reboot. Then it can't use the nvdec decoder until I run mpv without firejail again. So it seems that some file has to be created that enables access to the nvdec cuda decoder, and which is currently read-only for firejail and only survives until reboot. Maybe something in /tmp/ ?

I don't see anything in mpv.profile that limits access to /tmp (unless you have an mpv.local that does so). BUT there's a note mentioning nogroups sometimes causing issues with NVIDIA. Might be related to https://github.com/netblue30/firejail/issues/1945.

@ghost commented on GitHub (Feb 24, 2019): > -A very strange thing I've noticed is that if I run mpv without firejail once, it will work with firejail (and even with the mpv.profile) until I reboot. Then it can't use the nvdec decoder until I run mpv without firejail again. So it seems that some file has to be created that enables access to the nvdec cuda decoder, and which is currently read-only for firejail and only survives until reboot. Maybe something in /tmp/ ? I don't see anything in mpv.profile that limits access to /tmp (unless you have an mpv.local that does so). BUT there's a note mentioning `nogroups` sometimes causing issues with NVIDIA. Might be related to https://github.com/netblue30/firejail/issues/1945.

gitea-mirror commented

2026-05-05 08:16:36 -06:00

Author

Owner

@Ryujinra commented on GitHub (Feb 24, 2019):

I don't see anything in mpv.profile that limits access to /tmp (unless you have an mpv.local that does so). BUT there's a note mentioning nogroups sometimes causing issues with NVIDIA. Might be related to #1945.

The issue occurs even with --noprofile so I think it must be one of the hardcoded restrictions built into firejail interfering here. Once I run mpv without firejail though, I can then run mpv with the stock mpv.profile with nvdec working perfectly, which led me to believe it is a write permissions issue that is resolved after some relevant file is created that is needed for nvdec access. Not persisting on boot made me think it is /tmp, but perhaps there is other short-lived files involved in activating cuda.

If I could only enable/disable the builtin firejail restrictions individually I could probably bisect the built-in configuration until I find the issue, but I don't know of any way to override those.

@Ryujinra commented on GitHub (Feb 24, 2019): > I don't see anything in mpv.profile that limits access to /tmp (unless you have an mpv.local that does so). BUT there's a note mentioning `nogroups` sometimes causing issues with NVIDIA. Might be related to #1945. The issue occurs even with --noprofile so I think it must be one of the hardcoded restrictions built into firejail interfering here. Once I run mpv without firejail though, I can then run mpv with the stock mpv.profile with nvdec working perfectly, which led me to believe it is a write permissions issue that is resolved after some relevant file is created that is needed for nvdec access. Not persisting on boot made me think it is /tmp, but perhaps there is other short-lived files involved in activating cuda. If I could only enable/disable the builtin firejail restrictions individually I could probably bisect the built-in configuration until I find the issue, but I don't know of any way to override those.

gitea-mirror commented

2026-05-05 08:16:36 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (May 21, 2019):

@Ryujinra, did you ever get this figured out? My mpv apparently doesn't support nvdec, so I'm not able to test this 😕

[edit] Never mind. If I run firejail mpv --hwdec=nvdec <youtube link>, for example, then it "just works"™️

What exactly happens when it fails to work for you?

@chiraag-nataraj commented on GitHub (May 21, 2019): @Ryujinra, did you ever get this figured out? My `mpv` apparently doesn't support nvdec, so I'm not able to test this :confused: [edit] Never mind. If I run `firejail mpv --hwdec=nvdec <youtube link>`, for example, then it "just works":tm: What exactly happens when it fails to work for you?

gitea-mirror commented

2026-05-05 08:16:37 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (May 29, 2019):

I'm going to close this for now due to inactivity. @Ryujinra, please feel free to re-open if you are still running into this and can provide more info.

@chiraag-nataraj commented on GitHub (May 29, 2019): I'm going to close this for now due to inactivity. @Ryujinra, please feel free to re-open if you are still running into this and can provide more info.

gitea-mirror commented

2026-05-05 08:16:37 -06:00

Author

Owner

@ghost commented on GitHub (Apr 10, 2020):

UPDATE: The OP has added important information in #3335 affecting firejail users who use our mpv profile with nvdec HW decoder. Please follow the discussion there awaiting a more permanent fix to this issue.

@ghost commented on GitHub (Apr 10, 2020): UPDATE: The OP has added important information in #3335 affecting firejail users who use our mpv profile with nvdec HW decoder. Please follow the discussion there awaiting a more permanent fix to this issue.

Rows
Columns

[GH-ISSUE #2447] mpv: nvdec HW decoder cannot load even with --noprofile #1619