Passing a USB camera though docker, only works with --privileged

Technical Support
1

Hello everyone!

At this moment, we’ve been using a iMX8M Plus with a Dahlia carrier board, running Torizon OS. We have a i3 Systems thermal camera which we would like to interface. As the Torizon OS is pretty barebones, we use a Docker image to config and access our cameras. Our video cameras that support with video4linux work well using the same command line options as the ones stated in the Real Time Object Detection torizon sample. Our thermal camera however doesn’t work unless the --privileged docker option is enabled (which is really not advisable). The camera cgroups are already covered by the CLI options in the post before, but it seems that something else is not being passed to the docker container.

What else should I do to further investigate that?
cheers

2

Hi, I’m the Toradex AI Assistant. The Toradex Support team will follow up with you shortly!

Did you like my answer?

:+1: :-1:

Hello!

Running a Docker container with the --privileged flag grants the container full access to the host’s devices, which is generally not recommended due to security concerns. To resolve the issue of your thermal camera requiring this flag, you can try the following steps:

  1. Device Access: Ensure that the specific device node for your camera (e.g., /dev/video0) is accessible to the container. You can do this by using the --device flag in your docker run command, like so:

    docker run --rm -it --device=/dev/video0 your-docker-image

    Replace /dev/video0 with the actual device node of your camera.

  2. Bind Mounts: If your camera requires access to specific system directories or files, you may need to bind mount these into the container. For example:

    docker run --rm -it -v /path/on/host:/path/in/container your-docker-image

    Ensure that any necessary directories are mounted with the correct permissions.

  3. Cgroup Rules: If your camera uses specific cgroup rules, you can add these to your Docker run command using the --cgroup-parent or --device-cgroup-rule options. For example:

    --device-cgroup-rule='c 199:* rmw'

    Adjust the rule according to your camera’s requirements.

  4. Kernel Modules and Drivers: Verify that any required kernel modules or drivers for your camera are loaded on the host system. You can check this with lsmod and load any missing modules with modprobe.

  5. Permissions: Ensure that the user running the Docker container has the necessary permissions to access the camera device. This might involve adding the user to specific groups (e.g., video group).

By following these steps, you should be able to configure your Docker container to access the camera without needing the --privileged flag. If issues persist, consider checking the camera’s documentation for any additional requirements or configurations specific to its operation on Linux systems.

I hope this helps! If you have any more questions, feel free to ask.

Best regards,
Toradex AI Assistant.

Please, also check if these links can help you solve your problem:

TorizonCore Container Problem.

3

Hi @gabriel.ayres

Well… yeah… that’s exactly the idea behind Torizon OS :sweat_smile:.

The base OS should include only things that are common features,
while things that are specific to your application should go inside of the container.

We have some articles exactly about this.