# Docker container cannot access dynamically plugged USB devices

**URL:** <https://forums.balena.io/t/docker-container-cannot-access-dynamically-plugged-usb-devices/4277>\
**Category:** balenaOS\
**Tags:** docker\
**Created:** [October 31, 2018, 1:03pm UTC](https://forums.balena.io/t/docker-container-cannot-access-dynamically-plugged-usb-devices/4277 "2018-10-31T13:03:54Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![rapha](https://sea2.discourse-cdn.com/balena/user_avatar/forums.balena.io/rapha/32/1239_2.png) [@rapha](https://forums.balena.io/u/rapha)\
**Post date:** [October 31, 2018, 1:03pm UTC](https://forums.balena.io/t/docker-container-cannot-access-dynamically-plugged-usb-devices/4277/1 "2018-10-31T13:03:54Z")

</div>

I am trying to access a USB device (camera) inside my container running on Balena OS 2.24.0 rev2 on a Jetson TX2. It is a multi-container application and I am running the respective container with

```auto
    privileged: true
    devices:
      - '/dev:/dev'

```

If the camera is plugged in during container launch I can access it. If I unplug it and replug it I cannot anymore.  
For a normal Docker container the solution is to mount /dev: `-v /dev:/dev` in combination with running privileged. Then devices plugged in after the container is started are supported.  
However, on BalenaOS mount binding is not allowed. How could I go about it?

---

<div class="post-metadata">

**Author:** ![rapha](https://sea2.discourse-cdn.com/balena/user_avatar/forums.balena.io/rapha/32/1239_2.png) [@rapha](https://forums.balena.io/u/rapha)\
**Post date:** [November 4, 2018, 5:58pm UTC](https://forums.balena.io/t/docker-container-cannot-access-dynamically-plugged-usb-devices/4277/2 "2018-11-04T17:58:53Z")

</div>

Would it be a possibility to add another flag that will bind mount /dev to /dev?

---

<div class="post-metadata">

**Author:** ![jason10](https://sea2.discourse-cdn.com/balena/user_avatar/forums.balena.io/jason10/32/1464_2.png) [@jason10](https://forums.balena.io/u/jason10)\
**Post date:** [November 5, 2018, 1:56am UTC](https://forums.balena.io/t/docker-container-cannot-access-dynamically-plugged-usb-devices/4277/3 "2018-11-05T01:56:33Z")

</div>

I haven’t had to use the devices specification, wasn’t even familiar with it. On Intel NUC (ubuntu/debian) accessing /dev/ttyACM0, etc just works. except when the device locks up, of course.

---

<div class="post-metadata">

**Author:** ![rapha](https://sea2.discourse-cdn.com/balena/user_avatar/forums.balena.io/rapha/32/1239_2.png) [@rapha](https://forums.balena.io/u/rapha)\
**Post date:** [November 5, 2018, 7:31am UTC](https://forums.balena.io/t/docker-container-cannot-access-dynamically-plugged-usb-devices/4277/4 "2018-11-05T07:31:38Z")

</div>

For a normal Docker container the `devices` specification allows a bit more fine grained control than the broad `privileged` spec.

On Balena single containers always run in privileged mode, so if your hardware does not change after start of the container you should be able to access it.  
My issue is that hardware that is plugged in after the container is started is not accessible.

---

<div class="post-metadata">

**Author:** ![jason10](https://sea2.discourse-cdn.com/balena/user_avatar/forums.balena.io/jason10/32/1464_2.png) [@jason10](https://forums.balena.io/u/jason10)\
**Post date:** [November 5, 2018, 9:43pm UTC](https://forums.balena.io/t/docker-container-cannot-access-dynamically-plugged-usb-devices/4277/5 "2018-11-05T21:43:34Z")

</div>

Sorry to hear “issue is that hardware that is plugged in after the container is started is not accessible”  
That doesn’t appear to be an issue with the Intel NUCs.

There is a discussion about restarting a container from inside of the container or from another system by using the https api: [Restart container every 24 hours](https://forums.balena.io/t/restart-container-every-24-hours/4220)

---

<div class="post-metadata">

**Author:** ![rapha](https://sea2.discourse-cdn.com/balena/user_avatar/forums.balena.io/rapha/32/1239_2.png) [@rapha](https://forums.balena.io/u/rapha)\
**Post date:** [November 9, 2018, 10:48am UTC](https://forums.balena.io/t/docker-container-cannot-access-dynamically-plugged-usb-devices/4277/6 "2018-11-09T10:48:31Z")

</div>

Hi Jason,  
that sounds like an interesting workaround, thank you.

Still a rather annoying way of doing it though.

---

<div class="post-metadata">

**Author:** ![rapha](https://sea2.discourse-cdn.com/balena/user_avatar/forums.balena.io/rapha/32/1239_2.png) [@rapha](https://forums.balena.io/u/rapha)\
**Post date:** [November 9, 2018, 11:13am UTC](https://forums.balena.io/t/docker-container-cannot-access-dynamically-plugged-usb-devices/4277/7 "2018-11-09T11:13:10Z")

</div>

Ideally, I would like to have a another label to add to a multicontainer docker-compose.yaml that bind mounds /dev:/dev.

I’ve searched for the implementation of the existing labels on github, but couldn’t find it. Could somebody point me to the right spot?

---

<div class="post-metadata">

**Author:** ![jason10](https://sea2.discourse-cdn.com/balena/user_avatar/forums.balena.io/jason10/32/1464_2.png) [@jason10](https://forums.balena.io/u/jason10)\
**Post date:** [November 30, 2018, 9:38pm UTC](https://forums.balena.io/t/docker-container-cannot-access-dynamically-plugged-usb-devices/4277/8 "2018-11-30T21:38:32Z")

</div>

Hi Rapha,

Yes I agree, especially since we often don’t have reliable network access to our devices. Additionally we have found that when the USB connection to our device fails we have to physically power cycle the host system. Resets, reboots, device disconnections (physical) are not sufficient. Likely a device driver/usb chip issue.

So we’re looking into watchdogs and system power cycling.

---

<div class="post-metadata">

**Author:** ![rapha](https://sea2.discourse-cdn.com/balena/user_avatar/forums.balena.io/rapha/32/1239_2.png) [@rapha](https://forums.balena.io/u/rapha)\
**Post date:** [December 11, 2018, 12:54pm UTC](https://forums.balena.io/t/docker-container-cannot-access-dynamically-plugged-usb-devices/4277/9 "2018-12-11T12:54:47Z")

</div>

Hi @jason10,  
for us a simple restart of the container/service is sufficient.

---

<div class="post-metadata">

**Author:** ![rapha](https://sea2.discourse-cdn.com/balena/user_avatar/forums.balena.io/rapha/32/1239_2.png) [@rapha](https://forums.balena.io/u/rapha)\
**Post date:** [December 11, 2018, 1:40pm UTC](https://forums.balena.io/t/docker-container-cannot-access-dynamically-plugged-usb-devices/4277/10 "2018-12-11T13:40:02Z")

</div>

It appears that the fixed bind-mounts are defined in the [https://github.com/balena-os/meta-balena/blob/master/meta-resin-common/recipes-support/resin-mounts/resin-mounts.inc](https://github.com/balena-os/meta-balena/blob/master/meta-resin-common/recipes-support/resin-mounts/resin-mounts.inc) file.

I will try to add a custom rule for mounting /dev. A label would still be the nicer option, but I am not sure which dev can advise on that.

@petrosagg are you the right person to ask on how to ensure USB devices are accessible if plugged in after the Balena container is started and running?

---

<div class="post-metadata">

**Author:** ![jason10](https://sea2.discourse-cdn.com/balena/user_avatar/forums.balena.io/jason10/32/1464_2.png) [@jason10](https://forums.balena.io/u/jason10)\
**Post date:** [December 17, 2018, 7:17pm UTC](https://forums.balena.io/t/docker-container-cannot-access-dynamically-plugged-usb-devices/4277/11 "2018-12-17T19:17:38Z")

</div>

Can you use udev rules? In my Dockerfile.template I add a rule that identifies the video side of our usb device to appear as /dev/video\_boson:

```
RUN echo 'SUBSYSTEM=="video4linux", ATTR{name}=="Boson", SYMLINK+="video_boson"' > /etc/udev/rules.d/boson.rules

```

More advice on using udev at [http://www.reactivated.net/writing\_udev\_rules.html](http://www.reactivated.net/writing_udev_rules.html)

---

<div class="post-metadata">

**Author:** ![jaredro](https://avatars.discourse-cdn.com/v4/letter/j/d78d45/32.png) [@jaredro](https://forums.balena.io/u/jaredro)\
**Post date:** [January 8, 2019, 5:38pm UTC](https://forums.balena.io/t/docker-container-cannot-access-dynamically-plugged-usb-devices/4277/12 "2019-01-08T17:38:53Z")

</div>

Hi jason10,

I’m interested in how you got your udev rules to work within a docker container. When I try echoing the rule like you’ve suggested I get an error that the /etc/udev/rules.d directory doesn’t exist.

I’m working on a project involving several containers that need to be able to communicate with hardware connected to my Ubuntu 18.04 host. I have set up udev rules to give my hardware aliases when they are connected to ensure that the path to the hardware will never change.

I can get the containers the see and communicate with the HW via the udev alias using a device tag in my docker-compose file. But if the containers are brought up before the hardware is powered on they will error out saying that a device with my alias doesn’t exist. I’m trying to design the containers to be robust enough to come up, wait for the hw to be connected, open a session with it, and even be able to recover if it is ever disconnected.

If I set the containers to be privileged instead of using a device tag, I can communicate with the hardware using their non-aliased paths (ttyUSB0 etc.), but when I try to open a session with the udev alias I created it can’t find the device.

Is there a way to communicate with a device’s udev alias from a container without using a device tag? Or is there a way to recover from the container crashing when the path in the device tag isn’t found?

Your solution looks like it may be what I’m looking for but I haven’t gotten it to work so far.

Thanks!

---

<div class="post-metadata">

**Author:** ![jason10](https://sea2.discourse-cdn.com/balena/user_avatar/forums.balena.io/jason10/32/1464_2.png) [@jason10](https://forums.balena.io/u/jason10)\
**Post date:** [January 9, 2019, 11:18pm UTC](https://forums.balena.io/t/docker-container-cannot-access-dynamically-plugged-usb-devices/4277/13 "2019-01-09T23:18:40Z")

</div>

Hey @jaredro

This is for an Intel NUC, we’re connecting the devices before we power on, but they also work if we connect them after boot.

I’m not completely sure what else I had to add to my Dockerfile.template to get the udev rules to work. Using git pickaxe (git log -p -S “video4linux” …) to try to find what I added:

```
apt-get libsm6 libext6

# switch on systemd init system in container
ENV INITSYSTEM on
RUN echo 'SUBSYSTEM=="video4linux", ATTR{name}=="Boson", SYMLINK+="video_boson"' > /etc/udev/rules.d/boson.rules

```

If that doesn’t help, let me know!

---

<div class="post-metadata">

**Author:** ![rapha](https://sea2.discourse-cdn.com/balena/user_avatar/forums.balena.io/rapha/32/1239_2.png) [@rapha](https://forums.balena.io/u/rapha)\
**Post date:** [February 4, 2019, 4:00pm UTC](https://forums.balena.io/t/docker-container-cannot-access-dynamically-plugged-usb-devices/4277/14 "2019-02-04T16:00:14Z")

</div>

@jason10 I found the solution for our needs:

I had not seen the `UDEV=1` env one can set in the balena base images:  
[https://www.balena.io/docs/reference/base-images/base-images/#working-with-dynamically-plugged-devices](https://www.balena.io/docs/reference/base-images/base-images/#working-with-dynamically-plugged-devices)

With that one set, as well as `privileged: true` plugging and replugging works. The service in the docker-compose.yml looks like this:

```auto
  cameracontroller:
    image: balenalib/jetson-tx2-ubuntu:melodic
    environment:
      - UDEV=1
    restart: never
    privileged: true
    devices:
      - '/dev:/dev'
    command: /bin/bash

```

---

<div class="post-metadata">

**Author:** ![jason10](https://sea2.discourse-cdn.com/balena/user_avatar/forums.balena.io/jason10/32/1464_2.png) [@jason10](https://forums.balena.io/u/jason10)\
**Post date:** [February 4, 2019, 4:05pm UTC](https://forums.balena.io/t/docker-container-cannot-access-dynamically-plugged-usb-devices/4277/15 "2019-02-04T16:05:57Z")

</div>

Excellent!

---

<div class="post-metadata">

**Author:** ![rapha](https://sea2.discourse-cdn.com/balena/user_avatar/forums.balena.io/rapha/32/1239_2.png) [@rapha](https://forums.balena.io/u/rapha)\
**Post date:** [July 2, 2019, 7:24am UTC](https://forums.balena.io/t/docker-container-cannot-access-dynamically-plugged-usb-devices/4277/16 "2019-07-02T07:24:35Z")

</div>

One small addendum to [my earlier solution:](https://forums.balena.io/t/docker-container-cannot-access-dynamically-plugged-usb-devices/4277/14)

- If you are building your own image based on one iof the balena images: make sure to not overwrite the `ENTRYPOINT` in your Dockerfile as this would disable the udev.

---

<div class="post-metadata">

**Author:** ![imrehg](https://sea2.discourse-cdn.com/balena/user_avatar/forums.balena.io/imrehg/32/36_2.png) [@imrehg](https://forums.balena.io/u/imrehg)\
**Post date:** [July 2, 2019, 8:19am UTC](https://forums.balena.io/t/docker-container-cannot-access-dynamically-plugged-usb-devices/4277/17 "2019-07-02T08:19:14Z")

</div>

Hey @rapha, `UDEV=1` is not outdated, see in the source code of the entry script here

> <https://github.com/balena-io-library/base-images/blob/28844485a91b1408ffc550faa3b59e64809bc453/scripts/assets/entry.sh#L64-L68>

The `ENTRYPOINT` indeed shouldn’t be rewritten, as it’s in that entry sript that we are setting up the dymanic plugging (for the dev file system and udev properly)

Based on this, I think [https://www.balena.io/docs/reference/base-images/base-images/#working-with-dynamically-plugged-devices](https://www.balena.io/docs/reference/base-images/base-images/#working-with-dynamically-plugged-devices) should be up to date, and the important part was that your container needed `privileged: true`, right? Or anything else is out of data in that page?

Thanks a lot for the lot of feeback!

---

<div class="post-metadata">

**Author:** ![rapha](https://sea2.discourse-cdn.com/balena/user_avatar/forums.balena.io/rapha/32/1239_2.png) [@rapha](https://forums.balena.io/u/rapha)\
**Post date:** [July 2, 2019, 8:42am UTC](https://forums.balena.io/t/docker-container-cannot-access-dynamically-plugged-usb-devices/4277/19 "2019-07-02T08:42:01Z")

</div>

Hey @imrehg, thanks for the quick feedback. My main issue was that we overwrote the entrypoint.

The [https://www.balena.io/docs/reference/base-images/base-images/#working-with-dynamically-plugged-devices](https://www.balena.io/docs/reference/base-images/base-images/#working-with-dynamically-plugged-devices) section is a little confusing:

It mentions how to enable dynamic repluggin (showing UDEV=1), but follows that advice with `Major Changes` where you talk about `UDEV=off`.

Could you clarify that page to say that both true, 1, on will work and also point out that one should not overwrite the entrypoint 😉

Thanks for the quick response!

---

<div class="post-metadata">

**Author:** ![imrehg](https://sea2.discourse-cdn.com/balena/user_avatar/forums.balena.io/imrehg/32/36_2.png) [@imrehg](https://forums.balena.io/u/imrehg)\
**Post date:** [July 2, 2019, 8:45am UTC](https://forums.balena.io/t/docker-container-cannot-access-dynamically-plugged-usb-devices/4277/20 "2019-07-02T08:45:31Z")

</div>

Yeah, that clarification is due indeed, will mark it as our docs improvement. The point being is that by default `UDEV` is no longer turned on (which is the same as setting it to `off`. On the other hand, either setting it to `1`, `true` or `on` will turn it on, to keep with backwards compatibility.

Overwriting the `ENTRYPOINT` is always going to mess with base images (any kind of base images, in my experience) but I guess it’s worth clarifying on our side too not to do that. Thanks @rapha!

---

<div class="post-metadata">

**Author:** ![nikunj](https://avatars.discourse-cdn.com/v4/letter/n/91b2a8/32.png) [@nikunj](https://forums.balena.io/u/nikunj)\
**Post date:** [July 5, 2019, 9:33am UTC](https://forums.balena.io/t/docker-container-cannot-access-dynamically-plugged-usb-devices/4277/22 "2019-07-05T09:33:59Z")

</div>

Hi,

I am also facing the same issue as I have defined udev=1 and device volumes. Lets see my docker compose file,

```
version: '2'
volumes: 
  node-data:
services:
  wpe:
    restart: always
    build: ./
    privileged: true
    ports:
      - 8080:8080
  nodejs:
      build: './nodejs' # specify the directory of the Dockerfile
      environment:
      - UDEV=1
      ports:
        - "3000:3000" #specify ports forewarding
      volumes:
        - 'node-data:/node-data'
      devices:
      - '/dev:/dev'
      privileged: true
      restart: always

```

Can anyone help me?

Thanks,  
Nikunj

[Next page](https://forums.balena.io/t/docker-container-cannot-access-dynamically-plugged-usb-devices/4277.md?page=2)