Getting serial devices across the Docker boundary can be a challenge. If you’re using a Debian-based Linux distribution, here are the steps we’ve taken to successfully and reliably gain access to serial devices from inside Docker.
1. Set udev rule
By default, serial devices are mounted so that only root users can access the device. We need to add a udev rule to make them readable by non-root users. For security reasons, Losant’s Edge Agent does not run under a root user.
Create a file named /etc/udev/rules.d/99-serial.rules. Add the following line to that file:
KERNEL=="ttyUSB[0-9]*",MODE="0666"
MODE="0666" will give all users read/write (but not execute) permissions to your ttyUSB devices. This is the most permissive option, and you may want to restrict this further depending on your security requirements. You can read up on udev to learn more about controlling what happens when a device is plugged into a Linux gateway.
2. Mount in /dev folder from host to container
Serial devices are often ephemeral (can be plugged and unplugged at any time). Because of this, we can’t mount in the direct device or even the /dev/serial folder, because those can disappear when things are unplugged. Even if you plug them back in and the device shows up again, it’s technically a different file than what was mounted in, so Docker won’t see it. For this reason, we mount the entire /dev folder from the host to the container. You can do this by adding the following volume command to your Docker run command:
-v /dev:/dev
If your device is permanently attached, then using the --device option or a more specific volume mount is likely a better option from a security perspective. Since we are the authors of the Edge Agent, we obviously trust the code running in there and aren’t worried about exposing additional devices.
3. Run container in privileged mode
If you did not use the --device option and mounted in the entire /dev folder, you will be required to run the container is privileged mode. You can do this by adding the following to your Docker run command:
--privileged
4. Access device from the /dev/serial/by-id folder
If your device can be plugged and unplugged, Linux does not guarantee it will always be mounted at the same ttyUSBxxx location (especially if you have multiple devices). Fortunately, Linux will make a symlink automatically to the device in the /dev/serial/by-id folder. The file in this folder will always be named the same.