Module video_decode_ffmpeg 

2026-09-25: Decodes video containers to RGB frames by running ffmpeg as a subprocess, for every container that is not a GIF.

Owner: model-layers (vision input). Invariants:

• decode_frames refuses before building a process unless FfmpegPolicy::enabled.
• The binary gets its arguments as argv, never through a shell, and the container over stdin (pipe:0); no temp file is written.

The payload is an untrusted request body, so a decode is bounded: the frame count by -frames:v, the output by a capped read that kills the child once it passes max_output_bytes, and the wall clock by a watchdog that kills the child after timeout_secs.

Structs

FfmpegPolicy

2026-09-25: Operator policy for subprocess decoding. The serve builds it from the --video-* flags.

Enums

Availability

2026-09-25: What probe found.

Functions

decode_frames

2026-09-25: Decode bytes to RGB frames sampled at target_fps.

probe

2026-09-25: Check whether the configured decoder runs, with one -version invocation. The serve calls it at boot so a missing binary shows in the startup log rather than on the first video request.