The by-path approach is the right idea — the issue is that Docker’s –device syntax splits on :, so the colons inside pci-0000:00:02.0-card confuse the parser (container_path gets mangled). Two things to try:

1. Re-check the exact by-path filenames. They must match what’s actually in /dev/dri/by-path/ on your host — e.g. on Intel iGPU it’s usually pci-0000:00:02.0-card and pci-0000:00:02.0-render, but on some boards the PCI address differs. Run ls -l /dev/dri/by-path/ and confirm the symlink targets exist.

2. Drop card entirely — you likely only need the render node. Modern VAAPI/QSV transcoding in Jellyfin works fine with just the render device, no card0 needed:

devices:
  - /dev/dri/by-path/pci-0000:00:02.0-render:/dev/dri/renderD128

This is also the most robust fix for your reboot problem: the render node via by-path doesn’t shuffle between reboots, so your compose file stops breaking.

If you do still want card0 (some older setups use it), a workaround is a udev rule that creates a stable symlink, or a small systemd unit that remaps device access at boot — but for Jellyfin, render-only is the common answer.