I need to expose my USB interface to my LXD container and I'm using a Ubuntu 16.04 machine. Running "lsusb", I can see same the interfaces both on my host and container.

Inside my container I'm using a software that exploits this USB interface (and the related connected device) but during execution phase a message told:

"USB open failed: insufficient permissions"

How to add permanently the needed passthrough ?

Any suggestions will be appreciated

Many thanks


Please bear in mind I am new to answering, so edit as necessary.

Recently, I needed to add a PS3 controller to a container and was able to do so through the following:

First we need to find our devices information. namely it's vendorid and productid so let's run lsusb

The output should be similar to this:

Bus 002 Device 002: ID 8087:0024 Intel Corp. Integrated Rate Matching Hub
Bus 002 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 001 Device 004: ID 058f:6362 Alcor Micro Corp. Flash Card Reader/Writer
Bus 001 Device 006: ID 054c:0268 Sony Corp. Batoh Device / PlayStation 3 Controller

For our container we are interested in the ID part. So in my case 054c:0268

The 054c is going to be our "vendorid" and the 0268 is our "productid"

So based upon the configuration documentation, we should end up with a command like this to add our device

lxc config device add \
<ContainerName> \
<DeviceName> \
usb \

That is the minimum needed to add a device BUT since only vendorid is specified it will add ALL devices with a matching vendorid. if you want only that one specific device you may also specify the productid as well.

So for my case (to show a concrete example) I have:

lxc config device add \
pcsx2 \
ps3controllerblack \
usb \
vendorid=054c \

As shown, my ContainerName is "pcsx2" and the DeviceName can be anything you want, it does not have to corresond to anything, so mine is set to "ps3controllerblack", something easy for me to remember

One last thing to note is that even with the device added to the container, for my controller to properly work I also needed to add it's device file to the container as well.

So for me I had to find the device file, determine it's type (unix-char or unix-block) and then add it.

My controller provides a character device at /dev/input/js0 so my command ends up being:

lxc config device add \
pcsx2 \
joystickdevice \
unix-char \

And with that I should have access to my usb device. It may be necessary to add more to the configuration and specify the mode, uid or gid so that the proper users within the container may access it.

If you happen to input the wrong info into the command and need to do it over, first remove the device and then try again

lxc config device remove <ContainerName> <DeviceName>


lxc config device remove pcsx2 ps3controllerblack

The LXD GitHub has alot of documentation related to configuration.


Search there for USB and you will find what you need.

quote: Devices configuration

LXD will always provide the container with the basic devices which are required for a standard POSIX system to work. These aren't visible in container or profile configuration and may not be overriden.

Those includes:

/dev/null (character device)
/dev/zero (character device)
/dev/full (character device)
/dev/console (character device)
/dev/tty (character device)
/dev/random (character device)
/dev/urandom (character device)
/dev/net/tun (character device)
/dev/fuse (character device)
lo (network interface)

Anything else has to be defined in the container configuration or in one of its profiles. The default profile will typically contain a network interface to become eth0 in the container.

To add extra devices to a container, device entries can be added directly to a container, or to a profile.

Devices may be added or removed while the container is running.

Every device entry is identified by a unique name. If the same name is used in a subsequent profile or in the container's own configuration, the whole entry is overriden by the new definition.

Device entries are added through: lxc config device add [key=value]...

= = = end quote = = =

An example command:

lxc profile device add [key=value]...

Also, if you use LXD I'd highly recommend subscribe to the lxc-users mail alias as the developers monitor that and answer Q&A daily.


Lastly, there is an LXD sub-reddit on Reddit (if you use Reddit?) that isn't for support but does provide a lot of great info on LXD.


Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.