UPDATE:

I found a narrower fix. You do not need --security-opt label=disable. The ROCm Memory in use error was SELinux denying the container from mapping /dev/kfd. The AVC log showed a denial for map on /dev/kfd with type hsa_device_t. audit2allow pointed to the container_use_devices boolean, which covers this access.

Enable the boolean:

sudo setsebool -P container_use_devices 1

Then recreate or restart the container without --security-opt label=disable.

Previously

I ran into a weird issue running Ollama with ROCm in a rootless Podman container on Fedora. Models downloaded fine, but loading any model crashed with:

Memory critical error by agent node-0 ... Reason: Memory in use
llama-server process has terminated: signal: aborted (core dumped)

Setup:

• Fedora
• RX 6800 XT, gfx1030
• Rootless Podman
• Image: ollama/ollama:rocm
• GPU devices passed with: --device /dev/kfd --device /dev/dri

The container started, the GPU was detected, and the ROCm libraries inside the image looked fine. But every model load crashed with the memory error above.

What it was not. I checked:

• Device permissions: /dev/kfd and /dev/dri/renderD128 were accessible with read/write
• Missing ROCm libraries: the image already has them, and it detected the GPU
• HSA_OVERRIDE_GFX_VERSION: not needed in my case
• memlock limits: I raised the hard memlock limit for my user, but it made no difference

One clue that sent me down the wrong path: the same container worked when run rootful. That made me think it was a user namespace / memlock / permission issue, but it was not.

What fixed it:

--security-opt label=disable

The error message is misleading. My best guess is that SELinux is blocking the container process from mapping GPU memory through /dev/kfd, even though opening the device succeeds. That makes ROCm report something like "Memory in use", which is confusing because it is not actually a host RAM issue.

I did not confirm this in the SELinux audit log, so treat that part as a likely explanation rather than a proven root cause.

Working command:

podman run -d --device /dev/kfd --device /dev/dri --security-opt label=disable -v ollama:/root/.ollama -p 11434:11434 --name ollama docker.io/ollama/ollama:rocm

I searched Reddit for a while and couldn't find anything similar, so hopefully this saves someone a few hours of head-scratching. Happy hacking.