diff --git a/docker/main/install_deps.sh b/docker/main/install_deps.sh
index 80c159ccc9..bc0c96142d 100755
--- a/docker/main/install_deps.sh
+++ b/docker/main/install_deps.sh
@@ -10,7 +10,7 @@ apt-get -qq install --no-install-recommends -y \
     gnupg \
     wget \
     lbzip2 \
-    procps vainfo acl \
+    procps vainfo acl kmod pciutils \
     unzip locales tzdata libxml2 xz-utils \
     python3.11 \
     curl \
diff --git a/docker/main/rootfs/etc/s6-overlay/s6-rc.d/init-devices/run b/docker/main/rootfs/etc/s6-overlay/s6-rc.d/init-devices/run
index c3d94c4eb2..876e952d40 100755
--- a/docker/main/rootfs/etc/s6-overlay/s6-rc.d/init-devices/run
+++ b/docker/main/rootfs/etc/s6-overlay/s6-rc.d/init-devices/run
@@ -98,6 +98,23 @@ if [[ -d /dev/bus/usb ]]; then
     done < <(find /dev/bus/usb -type d -print0)
 fi
 
+# The Axelera runtime enumerates Metis cards by the colon-separated node name
+# that the vendor's udev rules create on a host (e.g. /dev/metis-0:1:0, a
+# symlink to the raw /dev/metis-0-1-0). Containers get the raw node only,
+# because docker never copies symlinks and there is no udev here, so recreate
+# the alias the runtime looks for.
+if compgen -G "/dev/metis-*-*-*" > /dev/null; then
+    for node in /dev/metis-*-*-*; do
+        [[ -c "$node" ]] || continue
+        base=${node##*/}
+        suffix=${base#metis-}
+        alias="/dev/metis-${suffix//-/:}"
+        if [[ ! -e "$alias" ]]; then
+            ln -s "$base" "$alias" && echo "[INFO] device access: created Metis alias ${alias}"
+        fi
+    done
+fi
+
 if [[ "$failed" -gt 0 ]]; then
     echo "[INFO] device access: granted ${granted} node(s), ${failed} failed"
 elif [[ "$granted" -gt 0 ]]; then