Here is how I have done this in an Unpriviledged container in ProxMox
Create unpriviledged LXC container (Ubuntu in my case), install docker, frigate, etc
Assumptions:
- LXC container uses default user/group mapping
- Container ID is 200
- Coral USB sits within
/dev/bus/usb/003
Create a convenience name for the container’s root group (100000)
proxmox$ groupadd -g 100000 lxc-frigate-root
Add these lines in the LXC config file /etc/pve/lxc/200.conf
usb0: host=1a6e:089a,usb3=1 # coral ID pre-load
usb1: host=18d1:9302,usb3=1 # coral ID post-load
lxc.cgroup2.devices.allow: c 189:* rwm # usb coral
lxc.mount.entry: /dev/bus/usb/003 dev/bus/usb/003 none bind,optional,create=dir
Add this to /etc/udev/rules.d/60-mycoraltpu.rules
SUBSYSTEMS=="usb", ATTRS{idVendor}=="18d1", ATTRS{idProduct}=="9302", GROUP="lxc-frigate-root"
SUBSYSTEMS=="usb", ATTRS{idVendor}=="1a6e", ATTRS{idProduct}=="089a", GROUP="lxc-frigate-root"
And it works!
Explanation: the udev rule recognises and assigns the Coral USB to group 100000 in Proxmox. Group 100000 is mapped to the Root group of the unpriviledged container. Doing this allows the LXC root group to read/write to the Coral USB on the Proxmox host.
In my system, sometimes the Coral is assigned to bus 002 rather than 003. So I added an additional line in the 200.conf file
# usb0: host=1a6e:089a,usb3=1 # coral ID pre-load (this entry not needed)
# usb1: host=18d1:9302,usb3=1 # coral ID post-load (this entry not needed)
lxc.cgroup2.devices.allow: c 189:* rwm # usb coral
lxc.mount.entry: /dev/bus/usb/003 dev/bus/usb/003 none bind,optional,create=dir
lxc.mount.entry: /dev/bus/usb/002 dev/bus/usb/002 none bind,optional,create=dir
UPDATE: perhaps it may be more ‘correct’ to assign Coral USB to Maybe not…plugdev
group, and assign the LXC root user (100000) to be a member of plugdev
group. On the other hand I think the Coral USB is not going to be ‘shared’ amongst other VMs/Containers so probably doesn’t matter.