Docker Access to Raspberry Pi GPIO Pins

When running Docker on the Raspberry Pi 2, how can we expose the GPIO pins to the Docker container?

On a Linux host, there are three possible ways to get access to the GPIO pins from within a Docker container.

1. Running Docker with the "--privileged" option

Starting a container like this will give the container full access to the host's devices, including GPIO:

$ docker run --privileged -d whatever

Check the Docker documentation on this option. It might not be the best choice depending on how tight your security requirements are.

2. Adding the /dev/gpiomem device

Rather than exposing all of the host's devices to the container, you can be specific and only expose the /dev/gpiomem device to the container at runtime. Be aware that this device needs kernel driver support within the host's Linux distribution. Recent releases of Raspbian should have this. Your mileage with other distributions may vary.

$ docker run --device /dev/gpiomem -d whatever

3. Using the sysfs filesystem on the host

The Pi's GPIO is represented within the host's file system underneath /sys/class/gpio. This can be accessed with user privileges via the virtual files in that file system. Use Docker volumes to expose this to your container:

$ docker run -v /sys:/sys -d whatever

Mind that using sysfs for GPIO is probably going to be slower than the device approach.

GPIO libraries

Which of these three approaches fits your needs will also depend on the libraries you are using when accessing GPIO. Not all libraries support all three of these options.

You would probably use docker volumes to expose the sysfs interface. For example, something like:

docker run -v /sys:/sys fedora bash

This would expose /sys on the host as /sys inside the container, and you would have access to the /sys/class/gpio hierarchy.

If you were using code that access the GPIO pins without using the sysfs interface you would need to expose whatever device node it is using inside the container, possibly with something like the --device argument to docker run.

I would use this image: https://github.com/acencini/rpi-python-serial-wiringpi, as a base image. Here you can easily access with python. Or you can decide to download node onto the image and use these two npm libraries to access through javascript

https://github.com/bryan-m-hughes/raspi -- https://github.com/bryan-m-hughes/raspi-gpio

The base for the whole thing is wiringPi as you can see in the Dockerfile, and that you have to run this command when you run up the image the first time:

docker run --device /dev/ttyAMA0:/dev/ttyAMA0 --device /dev/mem:/dev/mem --privileged -ti acencini/rpi-python-serial-wiringpi /bin/bash

Whats important here is that you open up dev ports and mem for wiringPi to access it. Privileged access to /dev/mem is required by wiringPi.

In application with onoff on raspberry pi 3B+, mounting /sys/devices/platform/soc/3f200000.gpio and /sys/class/gpio is enough.

docker run \
  -v /sys/devices/platform/soc/3f200000.gpio:/sys/devices/platform/soc/3f200000.gpio \
  -v /sys/class/gpio:/sys/class/gpio \
  ...

I am still looking for better solutions.

If you are running Azure IoT Edge and docker on it then following steps will help you out.

1. Add property "Privileged" : true into file deployment.template.json

       "modules": {
        "gpio": {
         "version": "1.0",
         "type": "docker",
         "status": "running",
         "restartPolicy": "always",
         "settings": {
           "image": "${MODULES.gpio}",
           "createOptions": {
            "HostConfig": {
              "Privileged": true
           }
         }
       }
     },
   

2. Comment out moduleuser creation in file Dockerfile.arm32v7. Moduleuser doesnt have enough permissions and therefore it ignores Privileged:true option. Without it docker will run in root privileges.

    # RUN useradd -ms /bin/bash moduleuser
    # USER moduleuser

3. Add reference to System.Device.Gpio. It is currenlty in prerelease but it works. https://github.com/dotnet/iot