4

PROBLEM:

So I've been trying to get a usb device (primesense - the OEM reference for the Kinect) to passthrough to an LXC container so I can develop without worrying about polluting my stable system with experimental libraries.

I think I've done everything necessary, but applications running inside the container cannot access the device.

I'm using Ubuntu 12.04 x64 host with LXC 1.0.0, container is created from the 12.04 template. (I am active over on askubuntu, but I believe the question fits here more)

Question:

How do you pass through usb to a (privileged) LXC container.

Actions Taken:

My udev rules for the host and the udev rules for the container are the same

SUBSYSTEM=="usb", ATTR{idProduct}=="0609", ATTR{idVendor}=="1d27",
MODE:="0666", OWNER:="root", GROUP:="video"

On the host the device node is visible as:

$ ls -l /dev/bus/usb/001/015
crw-rw-rw- 1 root video 189, 14 Jun 18 15:27 /dev/bus/usb/001/015

In the container the device node is visible as:

$ ls -l /dev/bus/usb/001/015 
crw-rw-rw- 1 root video 189, 14 Jun 18 22:07 /dev/bus/usb/001/015

Additionally, I have passed

sudo lxc-cgroup  --n CN1 devices.allow "c 189:* rwm"

In order to whitelist usb devices for lxc

Unfortunately, when I try to run an application on the Host, the device is recognized and works as expected. Running the same application in the container (with the same relevant libraries) causes the application to fail to find the device even when I explicitly pass the URI.

I'm trying to narrow down the issue to either a library bug (which I could fix but I don't want to commit down that rabbit hole yet) or something I'm missing with the permissions for LXC containers.

Community
  • 1
crasic
  • 426
  • 1
  • 4
  • 10

1 Answers1

2

Adding a whitelist rule through lxc-cgroup is not persistent, in testing my LXC containers I reset the container at some point and did not re-add the rule. The device node is created in the container correctly even without lxc white-listing (c *:* m is a default lxc rule) but the lxc container is denied access to the device when it tries to use it, without the right cgroup permissions it fails to work

Workaround is to add 

  lxc.cgroup.devices.allow = c 189:* rwm

to the relevant lxc.conf for your system.

crasic
  • 426
  • 1
  • 4
  • 10
  • I am trying to do something similer with LXD but not sure about a couple of things and stumbled upon your question. My issue is -> http://unix.stackexchange.com/questions/297045/how-to-make-a-usb-visible-in-lxd-container Also how do u know the device is now accessed inside via lxc container ? – Nishant Singh Jul 20 '16 at 08:55