Not able to use the camera inside docker as well not able to access the microphone

user_13819447 0
Viewed 354

I have created a model that can detect Eyes and faces using the haarcascades. This model is working perfectly in my local machine both windows and fedora. But when I try to run in it docker it shows an error Available platform plugins are:xcb is the error .

This error is coming when I run this cmd [docker run -it --device=/dev/video0:/dev/video0 image_name]

Also I have used the pyttsx3 module for speak text in the python code, but sound is also not coming.

Here is the Dockerfile Code:---

FROM python:latest
WORKDIR /root/Projects/Docker_Projects
COPY . .
RUN pip install --upgrade pip
RUN pip install speake3 
RUN pip install -r requirements.txt 
RUN apt-get update && \
      apt-get -y install sudo
RUN sudo apt-get install python3-pyqt5 -y
RUN apt-get update -y
RUN apt install libgl1-mesa-glx -y
RUN apt-get install 'ffmpeg'\
    'libsm6'\
    'libxext6' -y
RUN sudo apt-get install alsa-base -y
RUN sudo apt-get install alsa-utils -y
#RUN apt-get install qt5-default
RUN apt install espeak -y
RUN apt-get install alsa-utils -y
RUN pip install opencv-python 
CMD ["python","Computer_Vision.py"]
docker computer-vision fedora linux python
1 Answers

This is probably an SE Linux error. By default, the security policy prevents containers from accessing devices directly (because that's a huge potential route for container escape or other exploits).

You should be able to use audit2allow to create a rule that permits this. (Or, of course, you can sudo setenforce 0 — that's a fine way to test that this is the problem, but I do recommend creating the specific policy once you've got it figured out so that you have all of the protections selinux gives.)

I don't have a handy example for a video device, but here's an example with a USB serial device I set up for Home Assistant open source home automation software running in a container. (I'm using podman rather than docker, but the basic principles should be the same.) In my systemd journal, I see a bunch of log entries from the audit subsystem about AVCs.

The command sudo journalctl --boot _TRANSPORT=audit -g '^AVC' will show these specifically (or you can use just grep, or whatever). --boot means to show since the last system boot; you might want to narrow it down further. Anyway, I get a bunch of lines like:

Feb 01 17:45:13 example.org audit[15371]: AVC avc:  denied  { read write } for  pid=15371 comm="node" name="ttyUSB0" dev="devtmpfs" ino=735 scontext=system_u:system_r:container_t:s0:c214,c987 tcontext=system_u:object_r:usbtty_device_t:s0 tclass=chr_file permissive=1
Feb 01 17:45:13 example.org audit[15371]: AVC avc:  denied  { open } for  pid=15371 comm="node" path="/dev/zwave" dev="devtmpfs" ino=735 scontext=system_u:system_r:container_t:s0:c214,c987 tcontext=system_u:object_r:usbtty_device_t:s0 tclass=chr_file permissive=1
Feb 01 17:45:13 example.org audit[15371]: AVC avc:  denied  { ioctl } for  pid=15371 comm="node" path="/dev/zwave" dev="devtmpfs" ino=735 ioctlcmd=0x5401 scontext=system_u:system_r:container_t:s0:c214,c987 tcontext=system_u:object_r:usbtty_device_t:s0 tclass=chr_file permissive=1
Feb 01 17:45:13 example.org audit[15371]: AVC avc:  denied  { lock } for  pid=15371 comm="node" path="/dev/zwave" dev="devtmpfs" ino=735 scontext=system_u:system_r:container_t:s0:c214,c987 tcontext=system_u:object_r:usbtty_device_t:s0 tclass=chr_file permissive=1

The good news is: you don't really have to understand that in detail. Just make sure everything you see relates to the device in question (easy to add grep to make sure), and then pipe that to audit2allow, like this:

sudo journalctl --boot _TRANSPORT=audit -g '^AVC' | 
    audit2allow -m containervideo >  containervideo.te

Then, build the module and load it:

make -f /usr/share/selinux/devel/Makefile containervideo.pp
semodule -i containervideo.pp

This will install the containervideo.pp policy into your local config. You won't need to keep them around later.

user_4794260
Related