As an alternative to mounting full /dev/dri, there are symlinks under /dev/dri/by-path/ which you can use. IIUC they are linked by the used PCI slot, hence should be as stable as the physical order of the cards.
I use this pattern in a compose file:
...
devices:
- source: /dev/dri/by-path/pci-XXX-render
target: /dev/dri/renderD128
permissions: rwm





I used to run SFTPGO in a container as a NAS type service. Their default image is based on Debian, but they offer Alpine versions. Password authentication is enabled by default.