overthinkos/udev
ov/skills/udev/SKILL.md
MUST be invoked before any work involving: GPU device access rules, ov udev commands, udev rule management, or container GPU troubleshooting.
development
Updated Apr 27, 2026
$ install --global
skillsauthnpx skillsauth add overthinkos/overthink-plugins udevInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 27, 2026, 9:45 AM35.8s1 file scanned
SKILL.md
- name:
- udev
- description:
- |
- MUST be invoked before any work involving:
- GPU device access rules, ov udev commands, udev rule management, or container GPU troubleshooting.
Udev - GPU Device Access Rules
Overview
Manage udev rules that grant rootless containers access to GPU devices. Without these rules, DRM card nodes and AMD KFD devices may not be accessible to non-root users, blocking GPU features like NVENC encoding and ROCm compute.
Quick Reference
| Action | Command | Description |
|--------|---------|-------------|
| Show status | ov udev status | GPU devices, groups, rule status, fix suggestions |
| Print rules | ov udev generate | Print udev rule content to stdout |
| Install rules | ov udev install | Write rules file + reload udev (requires sudo) |
| Remove rules | ov udev remove | Delete rules file + reload udev (requires sudo) |
What the Rules Do
Rules are written to /etc/udev/rules.d/99-ov-container-access.rules:
# Card nodes: render group access for NVENC hardware encoding
SUBSYSTEM=="drm", KERNEL=="card[0-9]*", GROUP="render", MODE="0660"
# AMD KFD: ROCm compute access
SUBSYSTEM=="kfd", KERNEL=="kfd", GROUP="render", MODE="0660"
- DRM card nodes (
/dev/dri/card*) — set group torender, mode0660. Render nodes (renderD*) are already world-accessible; card nodes need explicit rules for NVENC - AMD KFD (
/dev/kfd) — set group torender, mode0660. Required for ROCm GPU compute
Rootless Podman's user namespace mapping prevents DRM master abuse, making this safe.
Status Output
ov udev status shows:
GPU Devices:
/dev/dri/card0 nvidia root:render 0660 OK
/dev/dri/renderD128 nvidia root:render 0666 OK
User Groups:
video: yes
render: yes
Udev Rules:
/etc/udev/rules.d/99-ov-container-access.rules: installed
Status: OK — GPU device access available for containers
If problems are detected, it prints specific fix commands.
Install Workflow
ov udev status # Check current state
ov udev install # Install rules (prompts for sudo)
Install writes the rules file, then runs:
sudo udevadm control --reload-rulessudo udevadm trigger --subsystem-match=drmsudo udevadm trigger --subsystem-match=kfd
Idempotent: skips if rules are already up to date.
Prerequisites
- User must be in the
rendergroup for GPU access - AMD GPU users also need the
videogroup ov udev statusshows exactusermodcommands if groups are missing
Cross-References
/ov:doctor— hardware detection and dependency checks (includes GPU)/ov-layers:nvidia— NVIDIA GPU runtime layer/ov-layers:rocm— AMD ROCm GPU compute layer/ov-layers:cuda— CUDA toolkit layer
Source
ov/udev.go.
When to Use This Skill
MUST be invoked when the task involves GPU device access, udev rules, or troubleshooting container GPU passthrough. Invoke this skill BEFORE reading source code or launching Explore agents.
Related Skills
overthinkos/agents
development
VerifiedTrustedCommunity
Claude Code multi-agent support in Overthink — sub-agents, dynamic workflows, and agent teams, and how each drives the existing `ov eval` disposable beds to test and verify. MUST be invoked before authoring or invoking an ov sub-agent / dynamic workflow / agent team, wiring agent-lifecycle hooks, or asking "which primitive should drive the R10 beds?".
SKILL.mdUpdated May 31, 2026
overthinkos/workspace-mount
tools
VerifiedTrustedCommunity
Mounts a virtiofs share tagged `workspace` at /workspace inside a VM guest via a systemd .mount unit. Use when a kind:vm entity shares a host directory into the guest and you need it auto-mounted (and re-mounted at every boot).
SKILL.mdUpdated May 30, 2026
overthinkos/android
development
VerifiedTrustedCommunity
MUST be invoked before any work involving: the `kind: android` schema kind, a `target: android` deploy, the `apk:` layer package format (installing Android apps declaratively), AndroidDeployTarget, an in-pod emulator OR a remote/physical adb-endpoint device, or nested `pod → android` deployment. The first-class Android device + app surface that sits above `ov eval adb`/`appium`.
SKILL.mdUpdated May 26, 2026
overthinkos/git-workflow
tools
VerifiedTrustedCommunity
Use when committing, branching, pushing, merging, tagging, creating PRs, or approving/merging PRs with gh — the feat/-branch, R10-gated, never-force-push landing workflow across the main repo + the plugins submodule + image/<distro> submodules. Covers sync-to-upstream, branch/worktree pruning, the fork+PR path for contributors without write access, and cross-repo @github landing order.
SKILL.mdUpdated May 25, 2026