Building a GPU workstation for visual effects on Amazon EC2: Part 2 – Linux

For many years Amazon Web Services (AWS) has been guiding customers in the deployment of powerful NVIDIA GPU-backed workstations for graphics-intensive workloads. With the recent expansion of our G-series Amazon Elastic Compute Cloud (Amazon EC2) graphics-based instances, we are excited to introduce new instance families that deliver enhanced performance and capabilities. We are also refreshing our comprehensive guidance on choosing and configuring these powerful virtual workstations.

This is the second post in a five-part series, focusing on the deployment of a Rocky Linux 9.5 visual effects (VFX) workstation, using Amazon DCV as a high-performance desktop display protocol.

“Amazon DCV gives me the ability to prioritise image quality or smooth performance and playback, depending on the tasks I am performing. It adapts quickly to any monitor used and when in full screen, I forget I am operating a remote workstation.”

— Giorgio Pitino, Head of Creative Operations, Outpost VFX

Prerequisites

This post assumes that you have already configured the following:

1. An active AWS account with increased GPU Amazon EC2 service quota limits.
2. A valid Amazon EC2 key pair in your AWS Region of choice.
3. A configured virtual firewall Security Group, with open TCP/UDP ports 22, 443, 8443, and 3389 limited to only your own IP address.
4. An AWS Identity and Access Management (IAM) profile with Amazon Simple Storage Service (Amazon S3) read access, for workstation usage.

We strongly recommend that you follow Part 1 of the series, Build a GPU workstation for visual effects on Amazon EC2: Part 1 – Setup, which goes through the preceding steps in detail.

Launching the Linux workstation

The AWS Marketplace offers an official Rocky Linux 9 x86-64 Amazon Machine Image (AMI) that can be used as a base AMI for our GPU workstation.

To use this AMI, you need to subscribe to the AMI to use the updates:

1. Log in to the AWS Management Console and navigate to the AWS Marketplace by searching for its name in the Service search bar, or by navigating:

Services > Cloud Financial Management > AWS Marketplace.

2. Choose Discover products in the left pane.
3. Search for “rocky linux 9 official” in the Search field.
4. Choose Rocky Linux 9 (Official) – x86_64 to view the marketplace offering.
5. Choose Continue to Subscribe to subscribe to this product.

6. To continue, choose Accept Terms (if you agree).
7. The subscription process starts, with Effective date showing pending. But when the subscription is complete (which can take a few minutes) this changes to the current date.

When the subscription process has completed, you can launch an EC2 instance from that AMI:

8. Navigate back to the AWS Marketplace service console page and choose Manage subscriptions.
9. Choose Launch new instance underneath the entry for Rocky Linux 9 (Official) – x86_64.
10. Choose Launch instances.
11. When prompted, specify your AWS Region, and choose Continue to launch through EC2.

This now opens the Amazon EC2 launch interface.

12. Give the instance a name, for example “my_linux_workstation”.
13. Note that the AMI has been pre-filled for you.
14. Under Instance type, choose g6.4xlarge.
15. Under Key pair name, open the list and choose your key pair. In the previous post we called it “ec2_test_keypair” to specify the password security credentials.
16. Edit the Network settings to adjust security and network placement:
    • Leave the Subnet to No preference.
    • Make sure that Auto-assign public IP is set to Enable, so that you can access the instance through the internet.
    • Under the Firewall (security groups) section of the Network Settings, choose Select existing security group, and specify your security group. In the previous post we named it “ec2_test_sg” to set up the firewall for the machine.
17. In Configuration storage, expand the default root volume from 10 GiB to 50 GiB of gp3 storage.Important: Enable encryption in the Advanced options by checking the Encrypted option and select the default AWS managed key (aws/ebs) or a customer managed AWS KMS key for enhanced control. Amazon Elastic Block Store (Amazon EBS) encryption protects your VFX project files, renders, and application data at rest. Encryption uses industry-standard AES-256 encryption and is transparent to applications with minimal performance impact.
18. Under Advanced details, specify the role that you created for workstation usage. In the previous post we called it “basic_workstation_role”, through the IAM instance profile list, so your workstation can access additional services.
19. Choose Launch instance.

You can now choose the link to the EC2 instance that has been launched or view it through the Instances pane in the Amazon EC2 Service page. The following screen capture shows the newly launched workstation in the EC2 Instances list, where you can confirm it is ready to use. When the “my_linux_workstation” instance is in the Running state, and the Status check is 3/3 checks passed, you can continue.

Figure 1: A screen capture of the EC2 Instances page, showing my_linux_workstation in a ready state

Configuring the Linux workstation

Now you proceed to configure the instance with the necessary libraries and software needed to make it a capable workstation for making 2D and 3D content. From a Mac terminal, Linux terminal, or Windows PowerShell, you can now SSH into the rocky user over the public IP address. To find the Public IPv4 address, choose the EC2 instance in the Instances pane (as shown in the preceding figure), and you should find the address located in the top/middle part of the Details section.

ssh rocky@<<PUBLIC_IP_ADDRESS>> -i <<YOUR_EC2_TEST_KEYPAIR_PEM_FILE>>

When you are logged in to the machine, you can start with password updates and general necessary packages:

# Set a password for your rocky user.
sudo passwd rocky

# Install some useful packages for later use.
sudo yum install wget nano unzip -y

# Install AWS CLI.
# https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html
cd ~
curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
unzip awscliv2.zip
sudo ./aws/install

# Install pip.
curl -O https://bootstrap.pypa.io/get-pip.py
python get-pip.py --user

# Make sure all packages are up-to-date.
sudo yum update -y

# Install GNOME.
sudo yum groupinstall "Server with GUI" -y

# Install kernel-devel and reboot.
sudo yum install kernel-devel -y
sudo reboot

Reconnect to the instance to disable nouveau drivers, in preparation for installing the GPU drivers:

# We need to disable the nouveau driver which conflicts with NVIDIA graphics cards.
# Make a module configuration to disable it.
sudo nano /etc/modprobe.d/nvidia_nouveau_off.conf

# Add the following lines
blacklist nouveau
options nouveau modeset=0

# CTRL-X and "y" to exit and save changes

# Ensure this file is also in usr/lib.
sudo cp /etc/modprobe.d/nvidia_nouveau_off.conf /usr/lib/modprobe.d/

# Rebuild the initramfs / boot process.
sudo dracut --force

# Set a new boot config based on the running system, and reboot.
sudo grub2-mkconfig -o /boot/grub2/grub.cfg
sudo reboot

Reconnect to the instance to begin installing the GPU drivers:

# Firstly, you can now double check that nouveau is not present on the system.
# You should see no output from the below:
lsmod | grep nouveau

At the time of writing, these are the current steps to install the correct NVIDIA GPU drivers.

# Install supporting libraries for NVIDIA GRID driver.
sudo dnf install -y make gcc elfutils-libelf-devel libglvnd-devel kernel-devel-$(uname -r)

mkdir ~/nvidia
cd ~/nvidia

# Copy the latest GRID driver from the public AWS S3 bucket.
aws s3 cp --recursive s3://ec2-linux-nvidia-drivers/latest/ .
chmod +x NVIDIA-Linux-x86_64*.run
sudo /bin/sh ./NVIDIA-Linux-x86_64*.run

# Follow the prompts to install:
# - you do not need to install 32 bit drivers
# - you should rebuild initramfs if requested.

# Check the driver is installed.
nvidia-smi -q | head

You should get an output as follows:

==============NVSMI LOG==============

Timestamp : Wed Jan 8 13:56:10 2025
Driver Version : 550.127.05
CUDA Version : 12.4
Attached GPUs : 1
GPU 00000000:31:00.0
Product Name : NVIDIA L4

Now set up the Amazon DCV server to stream the desktop to your local machine/client.

# Installing Amazon DCV.
# You can follow more detailed / up-to-date instructions at this link:
# https://docs.aws.amazon.com/dcv/latest/adminguide/setting-up-installing-linux-server.html

# First, disable the Wayland protocol.
sudo nano /etc/gdm/custom.conf
# Uncomment the "WaylandEnable=false" line.
# CTRL-X and "y" to exit and save changes

# Configure X Server -- check that the system is configured for graphical sessions:
sudo systemctl get-default
# If "multi.target" is returned then perform the following:
sudo systemctl set-default graphical.target

# start the X server
sudo systemctl isolate graphical.target

# Update xorg.conf with multi monitor connectivity.
sudo nvidia-xconfig --preserve-busid --enable-all-gpus --connected-monitor=DFP-0,DFP-1,DFP-2,DFP-3

# Restart X-Server.
sudo systemctl isolate multi-user.target
sudo systemctl isolate graphical.target

# Download and install the Amazon DCV server
mkdir ~/amazondcv
cd ~/amazondcv

# Install the key
sudo rpm --import https://d1uj6qtbmh3dt5.cloudfront.net/NICE-GPG-KEY

# Get the latest Rocky 9 Amazon DCV server.
# Note: The Amazon DCV team provide permanent links to the latest DCV software:
# https://www.amazondcv.com/latest.html
wget https://d1uj6qtbmh3dt5.cloudfront.net/nice-dcv-el9-x86_64.tgz
tar -xvzf ./nice-dcv-el9-x86_64.tgz

# 'cd' into the extracted folder -- note this will be version named, hence the generic line below.
cd $(ls -d */|head -n 1)

# install the server rpm -- note this will be version named, hence the generic line below.
sudo yum install $(ls nice-dcv-server*.rpm|head -n 1)

# Restart the X Server.
sudo systemctl isolate multi-user.target
sudo systemctl isolate graphical.target

The Amazon DCV server uses parameters to specify configuration options. On Linux this manifests as a file on disk.

# Adjust the Amazon DCV config files to enable
# the automatic creation of a session by the "rocky" user...
sudo nano /etc/dcv/dcv.conf

# Under [session-management] add the following line:
create-session = true

# Under [session-management/automatic-console-session] add the following line:
owner = "rocky"

# CTRL-X and "y" to exit and save changes.

# Start DCV and enable it to automatically restart on boot
sudo systemctl restart dcvserver
sudo systemctl enable dcvserver

# Finally, open up the firewall to allow Amazon DCV access.
sudo firewall-cmd --add-port=8443/tcp --permanent
sudo firewall-cmd --add-port=8443/udp --permanent
sudo firewall-cmd --reload

Note: Looking to the future of Linux based workstations, DCV now supports Wayland display drivers on RHEL 10, Rocky Linux 10, CentOS 10 and Ubuntu 26.04.

Now install the Wacom drivers:

mkdir ~/wacom
cd ~/wacom

# Download the drivers from (again replacing the link below with the latest version):
# https://github.com/linuxwacom/input-wacom/releases
wget https://github.com/linuxwacom/input-wacom/releases/download/v1.3.0/input-wacom-1.3.0.tar.bz2
tar jxf input-wacom-1.3.0.tar.bz2
cd input-wacom-1.3.0
sudo su
./configure
make && make install
modprobe wacom
dracut --force

# Setup Wacom Pressure Sensitivity
nano /etc/X11/xorg.conf.d/99-wacom-pressure2k.conf

# Add the following lines:
Section "InputClass"
    Identifier "Wacom pressure compatibility"
    MatchDriver "wacom"
    Option "Pressure2K" "true"
EndSection

# CTRL-X and "y" to exit and save changes.

# Setup Wacom with Amazon DCV and Pressure Sensitivity
# Described here: https://docs.aws.amazon.com/dcv/latest/adminguide/enable-stylus.html
sudo nano /etc/X11/xorg.conf

# Add these 2 sections to the end of the file
Section "InputDevice"
    Identifier "DCV Stylus Pen"
    Driver "dcvinput"
    Option "Pressure2K" "true"
EndSection

Section "InputDevice"
    Identifier "DCV Stylus Eraser"
    Driver "dcvinput"
    Option "Pressure2K" "true"
EndSection

# Add the following inside the ServerLayout section
InputDevice "DCV Stylus Pen"
InputDevice "DCV Stylus Eraser"

# CTRL-X and "y" to exit and save changes.

# Restart X display
sudo systemctl isolate multi-user.target
sudo systemctl isolate graphical.target

The local instance store NVMe devices need mounting. For more information, visit the Amazon EC2 User Guide.

# View the volumes -- note that only our nvme0n1 drive is available.
# Our secondary instance store is not listed.
df -h

Filesystem      Size  Used Avail Use% Mounted on
devtmpfs        4.0M     0  4.0M   0% /dev
tmpfs           7.4G     0  7.4G   0% /dev/shm
tmpfs           3.0G  1.3M  3.0G   1% /run
efivarfs        128K  3.8K  120K   4% /sys/firmware/efi/efivars
/dev/nvme0n1p4   49G   45G  3.9G  93% /
/dev/nvme0n1p3  936M  716M  221M  77% /boot
/dev/nvme0n1p2  100M  7.0M   93M   8% /boot/efi
tmpfs           1.5G   52K  1.5G   1% /run/user/42
tmpfs           1.5G   36K  1.5G   1% /run/user/1000

# View volumes mapped but not formatted or mounted.
# Note nvme1n1 -- our instance store - is listed but not mounted.
lsblk

NAME        MAJ:MIN RM   SIZE RO TYPE MOUNTPOINTS
nvme0n1     259:0    0    50G  0 disk 
├─nvme0n1p1 259:2    0     2M  0 part 
├─nvme0n1p2 259:3    0   100M  0 part /boot/efi
├─nvme0n1p3 259:4    0  1000M  0 part /boot
└─nvme0n1p4 259:5    0  48.9G  0 part /
nvme1n1     259:1    0 558.8G  0 disk

# Create a file system on that device
sudo mkfs -t xfs /dev/nvme1n1

# Create a directory to mount the new device.
sudo mkdir /data

# Mount the device to your new directory.
sudo mount /dev/nvme1n1 /data

# Confirm our instance store - nvme1n1 - is now mounted.
df -h

Filesystem      Size  Used Avail Use% Mounted on
devtmpfs        4.0M     0  4.0M   0% /dev
tmpfs            31G     0   31G   0% /dev/shm
tmpfs            13G  1.2M   13G   1% /run
efivarfs        128K  3.8K  120K   4% /sys/firmware/efi/efivars
/dev/nvme0n1p4   49G   44G  5.1G  90% /
/dev/nvme0n1p3  936M  716M  221M  77% /boot
/dev/nvme0n1p2  100M  7.0M   93M   8% /boot/efi
tmpfs           6.1G   36K  6.1G   1% /run/user/1000
/dev/nvme1n1    559G  4.0G  555G   1% /data

Finally, we show some examples of application-specific library setup. Each application potentially has its own list of necessary libraries to install, which can be referenced online. The following are some examples:

# SideFX Houdini :
# https://www.sidefx.com/Support/system-requirements/linux-package-requirements-for-houdini-205/
sudo yum install alsa-lib compat-openssl11 dbus-libs expat fontconfig glibc libatomic libevent libglvnd-glx libglvnd-opengl libICE libSM libX11 libX11-xcb libxcb libXcomposite libXcursor libXdamage libXext libXfixes libXi libxkbcommon libxkbcommon-x11 libXrandr libXrender libXScrnSaver libXt libXtst libzstd nspr nss nss-util openldap pciutils-libs tbb xcb-util xcb-util-image xcb-util-keysyms xcb-util-renderutil xcb-util-wm zlib -y

# Autodesk Maya
# https://help.autodesk.com/view/MAYAUL/2025/ENU/?guid=GUID-D2B5433C-E0D2-421B-9BD8-24FED217FD7F
sudo yum install epel-release -y
sudo yum install libnsl.x86_64 audiofile-dev compat-openssl11 gtk2 libffi libmng libglvnd-opengl libpng15 libpq libXp mesa-libGLU xcb-util-cursor xcb-util-wm xcb-util-image xcb-util-keysyms xcb-util-renderutil xorg-x11-fonts-ISO8859-1-75dpi xorg-x11-fonts-ISO8859-1-100dpi -y

And lastly, it is time to clean up.

cd ~
rm -rf ~/nvidia
rm -rf ~/amazondcv
rm -rf ~/Wacom

# Reboot before logging in
sudo reboot

Logging in to your workstation

To log in to your machine using Amazon DCV, you must set up the client software on your local machine:

1. On your local machine/laptop, open the Amazon DCV download webpage.
2. Expand the Amazon DCV Client entry that matches the Server version that you installed on your workstation.
3. Choose the relevant OS for your machine/laptop, for example Windows (x86_64).
4. Download the installer.
5. Run the installer.

When it is installed, we need to determine the Public IP address of the workstation to connect to:

1. In the Amazon EC2 Console, choose Amazon EC2 Dashboard.
2. Choose Instances (running).
3. Choose the “my_linux_workstation” EC2 instance, in the top pane of the screen.
4. Choose the copy icon next to the Public IPv4 address in the lower pane to copy the IP address.

Finally, use the Amazon DCV client to view the workstation:

1. Open the Amazon DCV client on your local machine.
2. Paste the preceding IP address and press Enter, then trust the connection.
3. You will see a security warning about an untrusted certificate. This is expected behavior because DCV uses a self-signed certificate by default. For this initial setup, it’s safe to accept the certificate and proceed with the connection. For a detailed explanation of why this warning appears and how to implement proper certificate security for production environments, see Amazon DCV Connection Security in Building a GPU workstation for visual effects with Amazon EC2: Part 5 – Security.
4. In the next Username / Password entry field, choose rocky, and the appropriate password to which you set that user.

After the connection is established, Amazon DCV opens and displays the remote workstation desktop. The following screen capture shows the running workstation, confirming that your remote session is active and the environment is ready to use. In this example, the Rocky Linux desktop is shown with SideFX Houdini open, displaying a rendered scene in the viewport against the Rocky Linux desktop background.

Figure 2: A screen capture of a Rocky Linux-based workstation

Cleaning up

Finally, you must turn off your instances when not in use, either through the AWS Management Console, or through other programmatic methods such as the AWS Command Line Interface (AWS CLI). You incur costs associated with a running machine, and so deactivating machines when not in use reduces your expenditure.

Deactivating instances can be done by choosing Terminate instance from the Instance state options of the workstation on the Amazon EC2 console. The instance shuts down and reports a “Terminated” state on the console, but it automatically disappears after a short time.

However, if you want to learn more about the various methods to deactivate an EC2 instance, and creating a persistent machine image of your Linux instance, then refer to Part 4 of the series: Building a GPU workstation for visual effects with Amazon EC2: Part 4 – Optimizations. Additionally, Part 4 will cover essential information on security practices for Linux EC2 instances, including build-time hardening and automated patch management to protect your workstation infrastructure from evolving threats.

Conclusion

In this post you have subscribed to and deployed an AWS Marketplace AMI of Rocky Linux to serve as your base image. Then, you modified it with GPU drivers, Wacom drivers, and other modules to make it a capable Linux-backed VFX workstation, using Amazon EC2 GPU accelerated G instance types.

You may also be interested in Part 3 of our series, Building a GPU workstation for visual effects with Amazon EC2: Part 3 – Windows, to learn how to create a Windows-backed VFX workstation.

We also recommend that you continue to Part 4 of our series, Building a GPU workstation for visual effects with Amazon EC2: Part 4 – Optimizations, to learn how to implement GPU optimizations and infrastructure to streamline the provisioning of workstations.

For more information contact us at aws-visual-compute-interest@amazon.com.

Further reading

If you want to augment a VFX workstation environment with a dedicated render farm, then consider the managed service AWS Deadline Cloud.

EC2 instance metrics, such as CPU and memory usage, are readily sent to Amazon CloudWatch logs, so you can access this data through the console and AWS CLI. This information can be pertinent to discern if an EC2 instance is being over-provisioned or under-provisioned for the work at hand. An over-provisioned instance has excessive CPU, memory, and networking resources for the current tasks and could be optimized for price. Alternatively, an under-provisioned instance does not have enough resources to cope. For more information visit the Amazon EC2 User Guide.

More advanced examples of using Amazon DCV can be found in the aws-samples GitHub repo. This includes methods to broker multiple users and instances. Furthermore, DCV Connection Gateway provides a single entry point so you can connect to multiple DCV sessions across different instances, streamlining access management and improving security through centralized authentication.

Commercial options also exist to perform artist/instance brokering, using Amazon DCV and Amazon EC2 Launch templates. An example of such an offering is Leostream.

For reference, examples of setting up Amazon DCV capable instances, using AWS CloudFormation templates as a method of deployment, can be found in this GitHub repo.

A greater depth of analysis of bit rates and latency surrounding Amazon DCV connections can be found in this AWS HPC post.

About the authors