Thanks for all the help, everything was working well until yesterday. Will try rebooting the machine when back home!
Ah ok, yes, I've passed it though on my docker compose file, is the DeviceAllow added underneath the /dev/dri bind mount?
As I previously mentioned, I'm not sure how Docker handles these things. The thing you'd be looking for is the devices.allow control group (cgroup) attribute. I could tell you how to set that attribute for systemd-nspawn, but not for Docker.
Edit:
A quick search online pointed to the --device-cgroup-rule which is passed on the docker run command line. So, I imagine you could have something like:
docker run --device-cgroup-rule='char-drm rw' ...
Of course, consult the Docker docs for yourself, as I personally try to stay away from it.
Reboot seems to have fixed it, thanks for all of the replies.
Did you ever get a definitive answer on the root cause? I seem to be having the same symptoms and you are on a Mac?