USB Device access from Docker

Question

In our CI we use Jenkins, In the jenkinfile I run a docker image that creates the binaries to flash onto the stm32 nucleo board. To be more precise the flashing process is done as post build process in the CMakeLists.txt file in the docker image. I know the stm32 board is available in the docker image as i tested it with lsusb. But the error openOCD is trowing is:

Error: libusb_open() failed with LIBUSB_ERROR_NO_DEVICE

I also tried to call the same openOCD command from the Jenkinfile(so outside the docker image) and there it gives me the error:

libusb_open() failed with LIBUSB_ERROR_ACCESS

If I use the command in the terminal it works. I think it has something to do with udev and access rules. But I have no idea how they are used or generated.

Questions:

• Why is the device not found by openOCD in the docker image even if it is listed when calling lsusb?
• Why is openOCD not able to access the device when called from a Jenkinsfile even if on the same machine the same command in a terminal works?
• If the problem of the second question is missing udev rules for openocd, how can i generate them in a scripted manner so that they work in a docker?

Thanks a lot for your help in advance.

Answer 1

Here is how I run OpenOCD in docker to program a Xilinx FPGA:

docker run --rm -it \
  --device-cgroup-rule='c 189:* rmw' \
  -v /dev:/dev \
  docker.lan:5000/openocd \
  openocd -f /opt/openocd/arty_a7.cf

The --device-cgroup-rule option is setting up access to the cgroup for character devices with major number 189 which can be found on the device node of the device you're trying to access in /dev.

Additionally the -v /dev:/dev is providing access to the device tree inside the container. This should probably just be the specific device you want to use, which would require udev rules to give it a persistent name.