We have an internal test system for our multi-platform software library which runs, with its zoo of third-party tools, inside an [Ubuntu] Docker container.
To keep things simple, the host machine AND the Docker container both run as the same user, test_user
, fixed as UID 1000/GID 1000; this way volumes can be mapped between the two without issue.
However, I now need the Docker container to be able to access devices on the host machine (e.g. GPIOs). This ONLY seems to work if I run the Docker container specifically as the root
user, i.e. this successfully permits access to GPIOs on the host (as evidenced by gpiodetect
, which uses the libgpio
API that we now want to test):
docker run -t --rm -i -u root --privileged -v /sys:/sys -v /dev:/dev docker_image /bin/bash
root@f1f7ca240c1e:/workdir# gpiodetect
gpiochip0 [pinctrl-bcm2711] (58 lines)
gpiochip1 [raspberrypi-exp-gpio] (8 lines)
...whereas, if I add test_user
to the root
group, both inside the Docker container and on the host machine, none of these do:
docker run -t --rm -i -u test_user --privileged -v /sys:/sys -v /dev:/dev docker_image /bin/bash
test_user@57130c86c196:/workdir$ gpiodetect
gpiodetect: unable to access GPIO chips: Permission denied
docker run -t --rm -i -u 1000:1000 --privileged -v /sys:/sys -v /dev:/dev docker_image /bin/bash`
test_user@57130c86c196:/workdir$ gpiodetect
gpiodetect: unable to access GPIO chips: Permission denied
Unfortunately running the Docker container as root
, as well as not being desirable, is not an easy option as it messes up the mappings with the host machine (lots of shouts of dubious users from Git and the like).
Is there a way to persuade Docker that the [non-root
] user it is running as has root
privileges and so can have GPIO access?
FYI, on the host:
host:~ $ groups test_user
test_user: test_user root
...and in the Docker container:
test_user@1716f343e8c7:/workdir$ groups test_user
test_user: test_user root
test_user@1716f343e8c7:/workdir$