Hi,
I have the following nested setup:
1. Proxmox PVE on bare metal (Intel Nuc / 5.15.158-2-pve)
2. Debian Stable as LXC container on 5.15.158-2-pve
3. Home Assistant as unprivileged Docker container (Docker version 27.1.1, build 6312585)
This works well, except for USB pass-through, when I update/restart Docker, when I get the error:
When I reboot either the Debian LXC or PVE as a whole the error goes away and Docker images start without a problem. --> actually, today it doesn't go away at all, neither rebooting Debian LXC or PVE solves the issue.
What doesn't work:
1. Restarting either Docker, the LXC, or PVE
2. Running docker system prune
3. Deleting /var/lib/docker/overlay2/ and rebuilding all containers/images
4. Running docker in privileged mode
Question 1: Why do I get this error and how can I solve this?
Question 2: Why do these pass-through USB ports show up under /mount/ on my Debian LXC container?
I've also asked the question on the Docker forum for the Docker perspective.
On Proxmox I have the following config:
Which gives me these links to pass through:
On my Debian LXC image I see the following:
On Docker I have the following compose file. Note that 'privileged: true' is disabled for security reasons:
This works when I boot the LXC fresh. When I try to restart the container, I get an error:
Looking at the specifics, the source file exists:
And the overlay source also exists:
however there is no 'merged' folder under the overlay directory structure. It seems Docker doesn't (re)create this?
Does anyone have any pointers? It's a bit annoying to have to restart the LXC to get docker images to work, and breaks a smooth docker update flow. I'm not sure if this is a Docker error or Proxmox, but since it involves USB pass through I thought I'd start here. Thanks in advance!
I have the following nested setup:
1. Proxmox PVE on bare metal (Intel Nuc / 5.15.158-2-pve)
2. Debian Stable as LXC container on 5.15.158-2-pve
3. Home Assistant as unprivileged Docker container (Docker version 27.1.1, build 6312585)
This works well, except for USB pass-through, when I update/restart Docker, when I get the error:
What doesn't work:
1. Restarting either Docker, the LXC, or PVE
2. Running docker system prune
3. Deleting /var/lib/docker/overlay2/ and rebuilding all containers/images
4. Running docker in privileged mode
Question 1: Why do I get this error and how can I solve this?
Question 2: Why do these pass-through USB ports show up under /mount/ on my Debian LXC container?
I've also asked the question on the Docker forum for the Docker perspective.
On Proxmox I have the following config:
HTTP:
tim@pve:~$ sudo cat /etc/pve/lxc/201.conf
#Debian LXC server
arch: amd64
cores: 4
features: nesting=1
hostname: proteus
memory: 16384
mp0: /mnt/bulk,mp=/mnt/bulk
net0: name=eth0,bridge=vmbr0,firewall=0,gw=172.17.10.1,hwaddr=7E:D5:09:E1:91:0D,ip=172.17.10.2/24,tag=10,type=veth
onboot: 1
ostype: debian
rootfs: thinpool_vms:vm-201-disk-0,size=300G
swap: 512
unprivileged: 1
lxc.idmap: u 0 100000 1010
lxc.idmap: g 0 100000 44
lxc.idmap: g 44 44 1
lxc.idmap: g 45 100045 60
lxc.idmap: g 105 103 1
lxc.idmap: g 106 100106 904
lxc.idmap: u 1010 1010 10
lxc.idmap: g 1010 1010 10
lxc.idmap: u 1020 101020 64515
lxc.idmap: g 1020 101020 64515
lxc.init.cmd: /sbin/init systemd.unified_cgroup_hierarchy=0
lxc.cgroup2.devices.allow: c 188:* rwm
lxc.mount.entry: /lxc/201/devices/FTDI_FT232R_USB_UART_AC2F17KR-container-link dev/usb-FTDI_FT232R_USB_UART_AC2F17KR-if00-port0 none bind,optional,create=file
lxc.cgroup2.devices.allow: c 166:* rwm
lxc.mount.entry: /lxc/201/devices/dresden_elektronik_ingenieurtechnik_GmbH_ConBee_II_DE2149131-container-link dev/usb-dresden_elektronik_ingenieurtechnik_GmbH_ConBee_II_DE2149131-if00 none bind,optional,create=file
lxc.cgroup2.devices.allow: c 226:* rwm
lxc.mount.entry: /dev/dri dev/dri none bind,optional,create=dirWhich gives me these links to pass through:
Bash:
tim@pve:~$ sudo ls -l /lxc/201/devices
crw-rw---- 1 100000 100020 166, 0 Aug 8 08:42 dresden_elektronik_ingenieurtechnik_GmbH_ConBee_II_DE2149131-container-link
crw-rw---- 1 100000 100020 188, 1 Jun 8 13:56 FTDI_FT232R_USB_UART_AC2F17KR-container-linkOn my Debian LXC image I see the following:
Bash:
tim@debian:~$ mount | grep usb
/dev/mapper/pve-root on /dev/usb-FTDI_FT232R_USB_UART_AC2F17KR-if00-port0 type ext4 (rw,relatime,errors=remount-ro)
/dev/mapper/pve-root on /dev/usb-dresden_elektronik_ingenieurtechnik_GmbH_ConBee_II_DE2149131-if00 type ext4 (rw,relatime,errors=remount-ro)
tim@debian:~/docker$ ls -l /dev/usb-*
crw-rw---- 0 root dialout 166, 0 Aug 8 08:12 /dev/usb-dresden_elektronik_ingenieurtechnik_GmbH_ConBee_II_DE2149131-if00
crw-rw---- 0 root dialout 188, 1 Jun 8 13:56 /dev/usb-FTDI_FT232R_USB_UART_AC2F17KR-if00-port0On Docker I have the following compose file. Note that 'privileged: true' is disabled for security reasons:
JSON:
tim@debian:~$ cat docker/home-assistant-compose.yml
# version: '3'
# https://www.home-assistant.io/installation/linux#docker-compose
# docker compose -f home-assistant-compose.yml up -d
services:
homeassistant:
container_name: homeassistant
image: "ghcr.io/home-assistant/home-assistant:stable"
volumes:
- /var/lib/homeassistant:/config
- /etc/localtime:/etc/localtime:ro
restart: unless-stopped
network_mode: host
devices:
- /dev/usb-dresden_elektronik_ingenieurtechnik_GmbH_ConBee_II_DE2149131-if00This works when I boot the LXC fresh. When I try to restart the container, I get an error:
Bash:
tim@debian:~/docker$ sudo docker compose -f home-assistant-compose.yml up -d
WARN[0000] Found orphan containers ([docker-app-1 docker-db-1 pigallery2]) for this project. If you removed or renamed this service in your compose file, you can run this command with the --remove-orphans flag to clean it up.
[+] Running 0/1
⠼ Container homeassistant Starting 0.4s
Error response from daemon: failed to create task for container: failed to create shim task: OCI runtime create failed: runc create failed: unable to start container process: error during container init: error creating device nodes: mount /dev/usb-dresden_elektronik_ingenieurtechnik_GmbH_ConBee_II_DE2149131-if00:/var/lib/docker/overlay2/06f5efd809d035a93128edc19bb936c62b21b18f6e3e6a402a881c3852aa81c3/merged/dev/usb-dresden_elektronik_ingenieurtechnik_GmbH_ConBee_II_DE2149131-if00 (via /proc/self/fd/6), flags: 0x1000: no such file or directory: unknownLooking at the specifics, the source file exists:
Bash:
tim@debian:~$ ls -l /dev/usb-dresden_elektronik_ingenieurtechnik_GmbH_ConBee_II_DE2149131-if00
crw-rw---- 0 root dialout 166, 0 Aug 8 08:12 /dev/usb-dresden_elektronik_ingenieurtechnik_GmbH_ConBee_II_DE2149131-if00And the overlay source also exists:
Bash:
tim@debian:~$ sudo ls -l /var/lib/docker/overlay2/06f5efd809d035a93128edc19bb936c62b21b18f6e3e6a402a881c3852aa81c3/
total 16
drwxr-xr-x 3 root root 4096 Aug 8 08:53 diff
-rw-r--r-- 1 root root 26 Aug 8 08:53 link
-rw-r--r-- 1 root root 927 Aug 8 08:53 lower
drwx------ 3 root root 4096 Aug 8 08:53 workhowever there is no 'merged' folder under the overlay directory structure. It seems Docker doesn't (re)create this?
Does anyone have any pointers? It's a bit annoying to have to restart the LXC to get docker images to work, and breaks a smooth docker update flow. I'm not sure if this is a Docker error or Proxmox, but since it involves USB pass through I thought I'd start here. Thanks in advance!
Last edited:
