title: systemd-nspawn /dev/dri/card0 privileges
body: <p>I'm trying hard to access <code>/dev/dri/card0</code> from the nspawn container and have no success. Is it even possible?</p>
  
  <p><code>/etc/systemd/system/systemd-nspawn@centos7.service.d/override.conf</code>:</p>
  
  <pre><code>[Service]
  DeviceAllow=/dev/dri rw
  DeviceAllow=/dev/shm rw
  DeviceAllow=char-drm rw
  ExecStart=
  ExecStart=/usr/bin/systemd-nspawn --quiet --boot --link-journal=try-guest --network-veth -U --settings=override --machine=centos7 --capability=all
  </code></pre>
  
  <p><code>/etc/systemd/nspawn/centos7.nspawn</code>:</p>
  
  <pre><code>[Exec]
  Boot=yes
  PrivateUsers=no
  
  [Files]
  Bind=/home/&lt;user&gt;
  Bind=/tmp/.X11-unix
  Bind=/cvmfs
  Bind=/dev/shm
  Bind=/dev/dri
  
  [Network]
  Private=no
  </code></pre>
  
  <p>In the machine I have:</p>
  
  <pre><code>$ strace -e open glxinfo
  ...
  open("/dev/dri/card0", O_RDWR|O_CLOEXEC) = -1 EPERM (Operation not permitted)
  ...
  $ ll /dev/dri/card0 
  crw-rw----+ 1 root video 226, 0 Dec 13 11:55 /dev/dri/card0
  $ groups
  &lt;user&gt; wheel video
  </code></pre>
  
  <p>Is there a way to make it work?</p>