I want to access special USB device (not a simple flash drive) from inside container. I bind /dev/bus/usb inside container, lsusb lists USBs effortlessly:

$ lsusb
Bus 002 Device 002: ID 0a89:0009 

but my program can't interact with this device.

1 Answer 1


systemd-nspawn handles permissions for devices through [cgroups][1]. By default, any container is granted with permissions only for common devices like /dev/null, /dev/zero, etc, and additionally to any device passed directly to --bind argument like --bind=/dev/vcs. This won't work with USB because /dev/bus/usb is a directory.

To grant permission for currently running container named my_container (supposedly you started it with systemd-nspawn directly from command line) execute as root:

$ echo 'c 189:* rwm' > \

c 189:* rwm means read write mknod permissions for any character device with type (identificator) 189 and any subtype. See also: https://kernel.org/doc/html/latest/admin-guide/cgroup-v1/devices.html You can find type and subtype of device with file:

$ file /dev/bus/usb/002/002

This permission will only last while container is running.

If you are using [email protected] or want to persist permissions with it, create

/etc/systemd/system/[email protected]/override.conf



(depending on whether you want access to USB from any systemd-nspawn container or only from my_container correspondingly) with the following content:

DeviceAllow=char-usb_device rwm 

usb_device is an alias. You can find other in /proc/devices. [1]: https://wiki.archlinux.org/index.php/cgroups


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .