Accessing host audio from a rootless Podman container

[znmeb]

I have a Universal Blue Bluefin DX host (Fedora 43 Silverblue plus some added drivers and software).

Client:        Podman Engine
Version:       5.7.1
API Version:   5.7.1
Go Version:    go1.25.4 X:nodwarf5
Git Commit:    f845d14e941889ba4c071f35233d09b29d363c75
Built:         Tue Dec  9 16:00:00 2025
Build Origin:  Fedora Project
OS/Arch:       linux/amd64

I'm trying to access host audio from a rootless container running Ubuntu 24.04. I saw this post: #20875 (comment) and this one https://www.redhat.com/en/blog/files-devices-podman but I still can't access the host sound card from the container.

Here's the podman run:

podman container run \
  --interactive \
  --tty \
  --security-opt=label=disable \
  --device=nvidia.com/gpu=all \
  --device=/dev/snd:/dev/snd \
  --group-add keep-groups \
  --name xen.assist --replace \
  --network host \
  --volume $OLLAMA_MODELS_HOST:$OLLAMA_MODELS_CONTAINER \
  localhost/xen.assist:latest \
  /sbin/init

The GPU is working; Ollama can run models in it just fine. But the audio isn't. There doesn't seem to be an audio group in the host, so I don't see why I'd need the --group-add keep-groups option. Is there something I'm missing, or am I stuck running this container privileged??

[znmeb]

I know a bit more about what's happening. It's a permission issue - the host audio devices are owned by root but the audio group can read and write them. The host audio group is number 63 and the container audio group is a different number - I don't even know if there is a group 63 in the container.

But now I'm thinking - in the host I never touch the raw devices - PipeWire does all that for me. The container is an Ubuntu container but it's running systemd and now I'm thinking, "Why can't I run PipeWire in the container and let the two PipeWire daemons take care of all this for me??"

[znmeb]

I did a little more research; pure Podman isn't up to the task and I'm switching to "toolbx" - https://containertoolbx.org/