Isaac Sim 6.0.1 GUI in unprivileged LXC + Docker: "Failed to acquire modesetting permission" — any way to run interactive GUI without DRM master / Web

Omniverse Isaac Sim
1

Isaac Sim Version

6.0.1
6.0.0
5.1.0
5.0.0
4.5.0
4.2.0
4.1.0
4.0.0
4.5.0
2023.1.1
2023.1.0-hotfix.1
Other (please specify):

Operating System

Ubuntu 24.04
Ubuntu 22.04
Ubuntu 20.04
Windows 11
Windows 10
Other (please specify):

GPU Information

  • Model: RTX PRO 6000 Blackwell Q MAX
  • Driver Version: 595.71.05

Topic Description

Headless rendering works perfectly. I cannot get an interactive GUI/livestream working because (a) WebRTC media needs UDP, which my network can’t carry, and (b) a headless NVIDIA Xorg fails at Failed to acquire modesetting permission because the container runs inside an unprivileged LXC that (by policy) can never be made privileged. Looking for any supported way to get an interactive view under these constraints.

Detailed Description

I run Isaac Sim 6.0.1 (nvcr.io/nvidia/isaac-sim:6.0.1) in Docker, and Docker itself runs inside an unprivileged LXC container (nested containerization). The LXC must remain unprivileged: 1 by policy — this cannot be changed, so --privileged and any DRM-master approach are permanently off the table. Remote access to the machine is TCP-only (SSH port-forwarding through a jump chain); there is no direct route and no way to carry UDP to the host.

My goal is an interactive Isaac Sim GUI (or an interactive livestream) that I can view remotely over this TCP-only connection.

Questions:

  1. Is there any supported way to run the interactive Isaac Sim GUI on a headless GPU inside an unprivileged container namespace (no DRM master, no privileged mode), viewable over a TCP-only connection?
  2. For the “backbuffers are not initialized” failure when rendering the GUI into a virtual display (Xvfb): is there a renderer/Kit setting that lets the RTX viewport render without creating a presentation swapchain (render offscreen and composite into the X window), so a normal X → VNC → TCP path could scrape it?
  3. Is there a WebRTC livestream configuration that operates fully over TCP (TCP media / ICE-TCP relay), so it could pass through an SSH tunnel without any UDP?
  4. If none of the above is possible, is the officially supported answer for this class of environment (unprivileged container + TCP-only) effectively “headless + programmatic rendering only” (Replicator / camera annotators / offscreen frames), with no interactive GUI?

Steps to Reproduce

  1. Run nvcr.io/nvidia/isaac-sim:6.0.1 in Docker with --network=host --user root, where Docker itself is inside an unprivileged LXC. /dev/nvidia-modeset (195:254) is passed into the container; host has nvidia-drm modeset=1 (/sys/module/nvidia_drm/parameters/modeset = Y).

  2. Attempt an interactive view via any of: (a) WebRTC livestream, (b) windowed GUI rendered into Xvfb + x11vnc/noVNC, (c) a headless NVIDIA Xorg with AllowEmptyInitialConfiguration + x11vnc.

  3. Headless (./runheadless.sh) succeeds; all three interactive paths fail as described.

Error Messages

GUI into a virtual display (Xvfb), repeating indefinitely:

[Error] [omni.kit.renderer.plugin] advanceCurrentFrame: backbuffers are not initialized!

Headless NVIDIA Xorg — GPU is found correctly:

(--) NVIDIA(0): Valid display device(s) on GPU-0 at PCI:xxx:0:0
(II) NVIDIA(0): NVIDIA GPU NVIDIA RTX PRO 6000 Blackwell ... (GB202GL-A) at PCI:xxx:0:0 (GPU-0)

…then fails fatally:

(EE) NVIDIA(GPU-0): Failed to acquire modesetting permission.
(EE) no screens found

Additional Information

What I’ve Tried

  1. WebRTC livestream (native client and Docker Compose web viewer): not viable — media requires UDP (47998), which cannot traverse my TCP-only SSH tunnel; opening TCP-only is documented as insufficient.
  2. Windowed GUI into Xvfb + x11vnc/noVNC (pure TCP): fails with backbuffers are not initialized. Tried both a bare Xvfb and a full window manager (fluxbox) with Xvfb +extension GLX +render. My reading is that the RTX renderer still attempts a Vulkan swapchain/presentation surface even against a virtual display, and surface creation fails here.
  3. Headless NVIDIA Xorg (nvidia driver + AllowEmptyInitialConfiguration, then x11vnc over TCP): got furthest — Xorg finds the GPU, loads GLX, enumerates outputs — but fails at Failed to acquire modesetting permission. This persists with --cap-add SYS_ADMIN, --cap-add SYS_RAWIO, and even docker --privileged. Since the whole setup is inside an unprivileged LXC, I believe no inner-Docker capability can grant DRM master.

Related Issues

2

Good summary of what you’ve tried – this is a well-understood constraint and
your analysis is correct.

The streaming launch script is headless – no DRM or display required for that path

This is an important clarification on how the streaming mode actually works. The
Docker container provides runheadless.sh (the standalone workstation package
has the equivalent isaac-sim.streaming.sh). Both launch the same kit file
(isaacsim.exp.full.streaming.kit) with --no-window passed to Kit:

exec "$SCRIPT_DIR/kit/kit" "$SCRIPT_DIR/apps/isaacsim.exp.full.streaming.kit" --no-window "$@"

In --no-window mode the renderer does not create a Vulkan presentation
swapchain and does not call XOpenDisplay or glfwInit. Instead it
allocates an off-screen color texture directly on the GPU. The
omni.kit.livestream.app extension (SharedFrameBuffer) then copies frames
from that off-screen texture into a CUDA buffer and feeds them to the WebRTC
video encoder. No DRM master, no X server, and no $DISPLAY are involved in
this path.

So the streaming launch itself does not hit the DRM/modesetting wall. The
constraint for your environment is on the network side, not the rendering
side – WebRTC’s ICE negotiation requires UDP, which your TCP-only SSH tunnel
blocks, and there is no currently user-configurable TURN relay to work around
that (see section below).

WebRTC over TCP-only

It seems that this is not officially supported at the moment. You can find more information here: Running Isaac Sim in a browser on TCP-only clouds (RunPod): WebRTC livestream can't work — here's a noVNC approach that does.

additional notes:

Container user: Your repro command uses --user root, but as of 6.0.1 the
Isaac Sim container runs as a rootless user (UID 1234) by default. The documented
run command uses -u 1234:1234, and the host volume mounts are chown’d to
match (sudo chown -R 1234:1234 ~/docker/isaac-sim). Running as root does not
affect the failures described above (those are kernel/network constraints), but
if you test the RTSP path with volume mounts, switch to -u 1234:1234 to avoid
permission errors on the cache/log/data directories. See the
Container Installation guide
for the full documented run command.

4

Hi @Vanocska188 — thanks for the detailed write-up! We provided a thorough breakdown in our earlier reply: the streaming launch path (–no-window) doesn’t require DRM master, and WebRTC over TCP-only is not currently supported, but the linked noVNC approach may suit your environment. Since we haven’t heard back, we’ll close this thread. If you still need help, please open a new topic and reference this one: Isaac Sim 6.0.1 GUI in unprivileged LXC + Docker: "Failed to acquire modesetting permission" — any way to run interactive GUI without DRM master / Web. Thanks!