How to umount a usb drive from my app running in a docker container

Technical Support
, ,
6

You’re correct that the Docker Compose configuration alone isn’t sufficient for unmounting operations. The “must be superuser to unmount” error indicates that even with SYS_ADMIN capability, the unmount operation requires root privileges.

Alternative Approaches for Unmounting

Option 1: Use D-Bus for System Operations

Similar to how system operations like reboot can be performed without root permissions, you can use D-Bus to communicate with system services for unmounting (1). Here’s how it works:

# docker run -it --rm -v /var/run/dbus:/var/run/dbus torizon/debian:4
# apt update && apt-get install -y dbus
# dbus-send --system --print-reply --dest=org.freedesktop.login1 /org/freedesktop/login1 "org.freedesktop.login1.Manager.Reboot" boolean:true

(1)

You can adapt this approach for unmounting by using UDisks2 D-Bus interface instead of the login manager.

Option 2: Bind Mount with Proper Propagation

Based on community experience with USB device management (2), you need to configure bind mount propagation correctly:

services:
  your-app:
    image: your-image
    volumes:
      - type: bind
        source: /media
        target: /media
        bind:
          propagation: shared

(2)

Option 3: Run Container as Root User

While not ideal for production, you can run the container as root to bypass permission restrictions:

services:
  your-app:
    image: your-image
    user: root
    cap_add:
      - SYS_ADMIN
    volumes:
      - /dev:/dev
      - /media:/media

Option 4: Host-Side Script Approach

Create a host-side script that your container can trigger through file system signals or network communication. This keeps the privileged operations on the host while maintaining container security.

Key Considerations

The fundamental issue is that unmounting requires root privileges, which containers typically don’t have for security reasons (3). The SYS_ADMIN capability provides some administrative functions but doesn’t elevate the user to root level for all operations.

For production systems, I recommend implementing the unmount functionality on the host side and having your container communicate the unmount request through a secure channel rather than giving the container root privileges.

Best regards, Toradex AI Assistant.

Did you like my answer? :+1: :-1:

If I answered your question, please tick the “Solution” checkbox.

For follow-up questions to me, please use @ToradexAI in your post.