Binding a device into a container via a shared directory

notes.md

That doesn't seem like a critical issue, just adjust the paths in my example to match whatever you need.

I think it is, unless /dev in the container is a bind-mount with shared propagation, how can I make /dev/nvidia appear inside the container without a subdirectory?

# mkdir /tmp/scratch
# podman run -it --rm --volume /tmp/scratch/:/tmp/scratch:shared docker.io/library/busybox
/ # ls -l /dev/
total 0
crw--w----    1 root     tty       136,   0 Sep 11 23:46 console
lrwxrwxrwx    1 root     root            11 Sep 11 23:45 core -> /proc/kcore
lrwxrwxrwx    1 root     root            13 Sep 11 23:45 fd -> /proc/self/fd
crw-rw-rw-    1 root     root        1,   7 Sep 11 23:45 full
drwxrwxrwt    2 root     root            40 Sep 11 23:45 mqueue
crw-rw-rw-    1 root     root        1,   3 Sep 11 23:45 null
lrwxrwxrwx    1 root     root             8 Sep 11 23:45 ptmx -> pts/ptmx
drwxr-xr-x    2 root     root             0 Sep 11 23:45 pts
crw-rw-rw-    1 root     root        1,   8 Sep 11 23:45 random
drwxrwxrwt    2 root     root            40 Sep 11 23:45 shm
lrwxrwxrwx    1 root     root            15 Sep 11 23:45 stderr -> /proc/self/fd/2
lrwxrwxrwx    1 root     root            15 Sep 11 23:45 stdin -> /proc/self/fd/0
lrwxrwxrwx    1 root     root            15 Sep 11 23:45 stdout -> /proc/self/fd/1
crw-rw-rw-    1 root     root        5,   0 Sep 11 23:45 tty
crw-rw-rw-    1 root     root        1,   9 Sep 11 23:45 urandom
crw-rw-rw-    1 root     root        1,   5 Sep 11 23:45 zero
crw-rw-rw-    1 root     root        5,   0 Sep 11 23:44 tty
crw-rw-rw-    1 root     root        1,   9 Sep 11 23:44 urandom
crw-rw-rw-    1 root     root        1,   5 Sep 11 23:44 zero

In another shell (or your hook):

# touch /tmp/scratch/video0
# mount --bind /dev/video0 /tmp/scratch/video0

Get the mount namespace (ideally from the state JSON, but I'm lazy):

# ps aux | grep ' sh$'
root      9268  0.0  0.0   1260   344 pts/0    Ss+  16:48   0:00 sh

Join the mount namespace and bind your device into place:

# nsenter -m -t 9268 sh
# touch /dev/video0
/ # mount --bind /tmp/scratch/video0 /dev/video0 
/ # ls -l /dev/video0 
crw-rw----    1 root     39         81,   0 Aug 25 04:37 /dev/video0