LXC USB Passthrough

otter90

New Member
Feb 24, 2020
2
1
3
49
Dear community,
i am new to this forum and to Proxmox. I have started to use Proxmox some weeks ago, comming from a simple Raspberry installation for my home automation and some other apps.
I have setup a VM for my FHEM home automation with two USB devices (CUL and Homematic HM-CFG-USB). Further some LXC for Weatherstation, Cups and so on.
Setting up the LXCs I faced the usual issues with passing through the USB devices:
a) USB devices are changing their IDs when rebooting.
b) /dev/bus/usb/001/00x have "Nobody/Nogroup" owner in the containers.
Because I have only very basic Linux knowledge I tried to find solutions by gooling in very helpful communities and forums like this. Allthough thousends of postings for these kind of issues exist, I did not find a solution that fits for me. After hours of googling, testing and frustration Ifound the following solution for me:
My Solution for a) Instead of mounting only the one device that I need in the respective container I mounted the whole directory, so that all devices are available in all containers. The devices that are additionally passthroud' to my VM are still working:
lxc.cgroup.devices.allow: c 189:* rwm
lxc.mount.entry: /dev/bus/usb/001 dev/bus/usb/001 none bind,optional,create=dir
My Solution for b) I defined an udev rule, that sets the owner/group to 100000:100000 for all USB devices:
SUBSYSTEM=="usb", OWNER="100000", GROUP="100000"
The combination of solution a) and b) seems to be working very well in my case, but I am not sure if this is an appropriate solution that will work long term without any side effects. Can someone please have a look? Maybe this is also an inspiration for others with the same challenge around passing through USB to LXcs.
Thank you very much !
Jens
 

Stefan_R

Proxmox Staff Member
Staff member
Jun 4, 2019
742
134
43
Vienna
For a): As long as you know which physical ports correspond to bus 001 and you only plug in devices that you actually want to pass through, this is a perfectly valid solution.

For b): It's technically fine and shouldn't break, however, assigning the CT's user to all USB devices might cause security issues or other problems for the host. When you say your USB devices "change IDs when rebooting", are you talking about their /dev/bus/... paths or the vendor/product IDs? The latter should be constant, you can see them when running 'lsusb' (ID xxxx:xxxx in hex numbers, that's vendor:product respectively). Then you could filter those in your UDEV rules (e.g. ATTRS{idVendor}=="abcd", ATTRS{idProduct}=="1234")
 
  • Like
Reactions: otter90

otter90

New Member
Feb 24, 2020
2
1
3
49
Thanks for the quick response.
a) Core of my solution is to pass all devices to all containers because i do not know which device number will be assigned to the required device. Obviously it is working, because all devices work where they should (container or VM).
b) You are right. By using vendor- and product ID i could be more specific when assigning group/owner. I will improve that.
 
  • Like
Reactions: Stefan_R

About

The Proxmox community has been around for many years and offers help and support for Proxmox VE and Proxmox Mail Gateway. We think our community is one of the best thanks to people like you!

Get your subscription!

The Proxmox team works very hard to make sure you are running the best software and getting stable updates and security enhancements, as well as quick enterprise support. Tens of thousands of happy customers have a Proxmox subscription. Get your own in 60 seconds.

Buy now!