feat(blender): Blender 5.2.2 LTS on fv-ml1 GPU 3, on demand (Prime)

Uses linuxserver/blender (Selkies Wayland desktop, NVENC), digest-pinned. The container sees only GPU 3, has restart "no", and runs only while in use, because GPU 3 is the reserve card for a full-size vLLM seat. Web desktop on :3001 with basic auth (vault fv-ml1/blender-web-password). /work is on /tank and is not backed up; /config lives under /opt/docker (restic). Acceptance: Cycles finds the card on OptiX and CUDA (sm_120 kernels ship in the build). The heavy self-test renders in 3.54 s on OptiX vs 22.71 s on CPU, a functional check with n=1. Web auth answers 401 without credentials and with a wrong password, and 200 with the right one.
2026-09-27 13:57:35 -07:00
parent 0b8632a7ed
commit 7ae7193c21
4 changed files with 111 additions and 0 deletions
@@ -0,0 +1,51 @@
+# blender
+
+**Blender 5.2.2 LTS on fv-ml1 GPU 3, on demand.** Agents drive it; there is also a browser
+desktop to watch it or take over. Prime, 2026-09-27: "go ahead with gpu 3, both". He does not
+use Blender himself, so the agent side (MCP) is the primary interface.
+
+| | |
+|---|---|
+| **Desktop** | `https://10.251.50.54:3001` (self-signed cert). Basic auth: user `blender`, password `secret get fv-ml1/blender-web-password`. |
+| **Image** | `lscr.io/linuxserver/blender:5.2.2-ls241@sha256:9216c77a…` (Selkies 2.0 Wayland desktop, NVENC stream). |
+| **GPU** | GPU 3 only (`NVIDIA_VISIBLE_DEVICES=3`). About 270 MiB is held while the desktop runs. |
+| **Files** | `/work` → `/tank/blender` (projects, assets, renders; **not backed up**). `/config` → `/opt/docker/data/blender` (prefs, add-ons; restic). Files are owned by infra-ops (uid 1002), so agents can `scp` in and out. |
+
+## ⚠ On demand: GPU 3 is borrowed
+
+GPU 3 is the fleet's reserve card for a full-size vLLM seat (`servers/fv-ml1/README.md`).
+Blender uses it only while in use:
+
+```bash
+ssh infra-ops@10.251.50.54 'cd /opt/docker/compose/blender && docker compose up -d'   # start
+ssh infra-ops@10.251.50.54 'cd /opt/docker/compose/blender && docker compose down'    # stop, card back to 0
+```
+
+`restart: "no"`, so a reboot never brings it back. **When a big seat moves onto GPU 3, Blender
+stays down.**
+
+## Headless rendering (no desktop needed)
+
+```bash
+ssh infra-ops@10.251.50.54 'docker exec -u abc blender blender -b /work/<file>.blend -E CYCLES -o /work/out/frame_#### -a -- --cycles-device OPTIX'
+```
+
+Run as `-u abc`, the image's user, mapped to uid 1002, so outputs land owned by infra-ops.
+
+## Acceptance (2026-09-27, 1356)
+
+- Cycles sees the card on both OptiX and CUDA: "NVIDIA RTX PRO 6000 Blackwell Max-Q Workstation
+  Edition". The build ships `kernel_sm_120.cubin` plus OptiX PTX.
+- Self-test (`/tank/blender/render_test.py`): a subdivided glass monkey, 1920×1080, 1024 samples,
+  32 bounces, no denoise. **OptiX 3.54 s against CPU 22.71 s (96 threads).** That is n=1 per
+  device: a functional check that the GPU is really used, not a benchmark. A trivial default-cube
+  scene could not separate them (0.59 s against 0.65 s), which is why the self-test scene is heavy.
+- Web auth: no credentials gives 401, a wrong password 401, the right one 200.
+- Selkies: "Render node 1 encodes H264, AV1, H265 on nvenc"; the Wayland renderer runs GL on GPU 3.
+
+## Agent control (MCP)
+
+Being researched with dvalin-smithy-dev: which Blender MCP server, and how it reaches Blender
+across hosts. This section fills in once the choice is made. ⚠ Most Blender MCP add-ons expose
+"run arbitrary Python inside Blender" on a TCP port. Treat that port like a shell: bind it to
+the container or the LAN only, never publish it wider.