Currently, docker does not allow users to make devices accessible by the containers, other than at the start of the container (with "docker run --device=/dev/blah image").
This forces a restart whenever a new device needs to be accessed by the container.
It would be useful, if not necessary for a few enterprise use-cases, to have the ability to add devices at runtime.
I have a few simple personal use-cases:
- Running security software, like a security monitor, in a container and needs to attach new devices without stopping the whole software. It would be unacceptable to lose a video feed for a few seconds every time a new camera is to be installed/replaced. (Using GigE Vision cameras here, which are USB, not network cameras)
- Running Chrome in a container, but due to sporadic USB disconnection, the USB webcam gets identified as a new v4l2 device. Chrome just needs access to the new device, but it is extremely annoying to restart the whole browser just because one page needs video from the webcam. (I'm testing to see if I can use docker for EVERYTHING, including GUI)
It might be possible to circumvent this by running it in privileged-mode and giving the container access to the entire /dev, but this gives way too much access to the container.
I haven't looked at docker's code to see if it's feasible/difficult or not. But I'd think the developers would know this right away.
What do you think?
Currently, docker does not allow users to make devices accessible by the containers, other than at the start of the container (with "docker run --device=/dev/blah image").
This forces a restart whenever a new device needs to be accessed by the container.
It would be useful, if not necessary for a few enterprise use-cases, to have the ability to add devices at runtime.
I have a few simple personal use-cases:
It might be possible to circumvent this by running it in privileged-mode and giving the container access to the entire /dev, but this gives way too much access to the container.
I haven't looked at docker's code to see if it's feasible/difficult or not. But I'd think the developers would know this right away.
What do you think?