As an alternative to mounting full /dev/dri, there are symlinks under /dev/dri/by-path/ which you can use. IIUC they are linked by the used PCI slot, hence should be as stable as the physical order of the cards.

I use this pattern in a compose file:

...
devices:
  - source: /dev/dri/by-path/pci-XXX-render
    target: /dev/dri/renderD128
    permissions: rwm