OpenGL/WebGL rendering fails when --net host is applied to nvidia-docker run

[fadams]

I've been playing with nvidia-docker to get WebGL running in a containerised chrome image.

As I was experimenting I was seeing errors on WebGL pages to the effect that WebGL was supported but disabled, so to try to get to the bottom of things I went back to basics to try and get glxgears running. I managed that with the following simple Dockerfile

FROM debian:stretch-slim

# nvidia-docker hooks
LABEL com.nvidia.volumes.needed="nvidia_driver"
ENV LD_LIBRARY_PATH /usr/local/nvidia/lib:/usr/local/nvidia/lib64:${LD_LIBRARY_PATH}

# Install glxgears
RUN apt-get update && \
    # Add the packages used
    apt-get install -y --no-install-recommends \
	mesa-utils && \
	rm -rf /var/lib/apt/lists/*

ENV LIBGL_DEBUG verbose

ENTRYPOINT ["glxgears"]

and run script

#!/bin/bash

if test -c "/dev/nvidiactl"; then
    DOCKER_COMMAND=nvidia-docker
else
    DOCKER_COMMAND=docker
fi

# Create .Xauthority.docker file with wildcarded hostname.
XAUTH=${XAUTHORITY:-$HOME/.Xauthority}
DOCKER_XAUTHORITY=${XAUTH}.docker
cp --preserve=all $XAUTH $DOCKER_XAUTHORITY
echo "ffff 0000  $(xauth nlist $DISPLAY | cut -d\  -f4-)" \
    | xauth -f $DOCKER_XAUTHORITY nmerge -

$DOCKER_COMMAND run --rm \
    -e DISPLAY=unix$DISPLAY \
    -v /tmp/.X11-unix:/tmp/.X11-unix \
    -e XAUTHORITY=$DOCKER_XAUTHORITY \
    -v $DOCKER_XAUTHORITY:$DOCKER_XAUTHORITY \
    glxgears

On my system with driver 375.66 and two Titan X devices glxgears runs happily.

However what I noticed as I was comparing the nvidia-docker run for glxgears with what I had for chrome was that my chrome had "--net host" set, and sure enough when I changed the glxgears run script to read:

$DOCKER_COMMAND run --rm \
    --net host \
    -e DISPLAY=unix$DISPLAY \
    -v /tmp/.X11-unix:/tmp/.X11-unix \
    -e XAUTHORITY=$DOCKER_XAUTHORITY \
    -v $DOCKER_XAUTHORITY:$DOCKER_XAUTHORITY \
    glxgears

It starts fine with no errors, but the window that was previously rendering the gears appears but remains resolutely black. Similarly, when I removed --net host from my run script for chrome, sure enough WebGL started to work properly. So it looks like --net host is conflicting in some way with whatever is being set by nvidia-docker

It'd be useful to know what's happening and any workarounds in case I actually do need to run accelerated containers with --net host

Many thanks.

[3XX0]

You can add --device=/dev/nvidia-modeset as a workaround.
However note that *GL is currently not supported in nvidia-docker so you might stumble upon other issues.

[fadams]

Many thanks, that's cool, adding --device=/dev/nvidia-modeset stops the blanking when --net host is set for me too.

A couple of things though:

1. Could you explain what's happening? That is why adding --net host causes the blanking and why --device=/dev/nvidia-modeset fixes it? I'm guessing it's something to do with the flags that are being transparently set on docker run by the nvidia-docker wrapper. I'm just curious really, but it's nice to understand things a little especially for fairly non-obvious things like this.

2. I appreciate that it's likely to be a case of priorities, but it's a little surprising that "*GL is currently not supported" in nvidia docker given that GPUs are graphics processors, I guess the priority is cloud compute, but I'd have assumed that cloud based rendering is something that is likely to become increasingly prevalent? Again, just curious really as, tweaks aside, most of the things I've tried seem to be working so far :o)

Thanks again, I'm really liking having GPU access in my containers.