{"record":{"id":"90d4d650840342bc","repo":"blakeblackshear/frigate","slug":"make-sure-to-run-docker-in-privileged-mode","errorCode":null,"errorMessage":"Make sure to run docker in privileged mode.","messagePattern":"Make sure to run docker in privileged mode\\.","errorType":"exception","errorClass":"Exception","httpStatus":null,"severity":"critical","filePath":"frigate/detectors/plugins/rknn.py","lineNumber":93,"sourceCode":"        self.runner = RKNNModelRunner(\n            model_path=model_props[\"path\"],\n            model_type=config.model.model_type.value\n            if config.model.model_type\n            else None,\n            core_mask=core_mask,\n        )\n\n    def __del__(self):\n        if hasattr(self, \"runner\") and self.runner:\n            # The runner's __del__ method will handle cleanup\n            pass\n\n    def get_soc(self):\n        try:\n            with open(\"/proc/device-tree/compatible\") as file:\n                soc = file.read().split(\",\")[-1].strip(\"\\x00\")\n        except FileNotFoundError:\n            raise Exception(\"Make sure to run docker in privileged mode.\") from None\n\n        if soc not in SUPPORTED_RK_SOCS:\n            raise Exception(\n                f\"Your SoC is not supported. Your SoC is: {soc}. Currently these SoCs are supported: {SUPPORTED_RK_SOCS}.\"\n            )\n\n        return soc\n\n    def parse_model_input(self, model_path, soc):\n        model_props = {}\n\n        # find out if user provides his own model\n        # user provided models should be a path and contain a \"/\"\n        if \"/\" in model_path:\n            model_props[\"preset\"] = False\n\n            # Check if this is an ONNX model or model without extension that needs conversion\n            if model_path.endswith(\".onnx\") or not os.path.splitext(model_path)[1]:","sourceCodeStart":75,"sourceCodeEnd":111,"githubUrl":"https://github.com/blakeblackshear/frigate/blob/ca18b8dc131ccb3e086f13a780853b775ef13426/frigate/detectors/plugins/rknn.py#L75-L111","documentation":"The RKNN detector reads /proc/device-tree/compatible to identify the Rockchip SoC; on a normal host this file exists, but inside an unprivileged Docker container device-tree paths are not accessible and FileNotFoundError maps to 'Make sure to run docker in privileged mode.' It is raised from get_soc during detector __init__.","triggerScenarios":"Starting the RKNN detector in a container without privileged mode or without the /proc/device-tree bind mount, so open('/proc/device-tree/compatible') raises FileNotFoundError.","commonSituations":"Running the Frigate container with default (non-privileged) security settings on Rockchip hardware; docker run without --privileged; Kubernetes pod missing privileged securityContext; compose file missing privileged: true.","solutions":["Run the Frigate container in privileged mode (docker run --privileged / compose privileged: true) as Frigate Rockchip docs require","Alternatively bind-mount /proc/device-tree (and the NPU devices) into the container if privileged mode is not allowed","Confirm you are on supported Rockchip hardware; otherwise pick another detector type"],"exampleFix":"# docker-compose.yml\n# before\nservices:\n  frigate: {}\n# after\nservices:\n  frigate:\n    privileged: true\n    # plus mapped /dev/dri, /dev/dma_heap etc per docs","handlingStrategy":"validation","validationCode":"import os\n\ndef can_read_soc() -> bool:\n    return os.path.exists('/proc/device-tree/compatible')","typeGuard":null,"tryCatchPattern":"try:\n    detector = LocalDetector(detector_config)\nexcept Exception as e:\n    if 'privileged mode' in str(e):\n        raise SystemExit('Restart Frigate container with privileged: true') from None\n    raise","preventionTips":["Run the Frigate Rockchip container with privileged: true","Alternatively bind-mount /proc/device-tree and NPU devices","Add a preflight check for /proc/device-tree/compatible on Rockchip deployments"],"tags":["rknn","rockchip","docker","privileged","permissions"],"backgroundTag":"container-permission-denied","analyzedSha":"ca18b8dc131ccb3e086f13a780853b775ef13426","analyzedAt":"2026-08-27T11:28:05.618Z","schemaVersion":2},"datasetVersion":"2026-08-27T13:17:12.746Z"}