Mount full /dev/input for dynamic input devices?

[embik]

Hi, thanks for the plugin! It's been very helpful so far.

I'm currently trying to get Sunshine to run with sway in a Kubernetes pod. Unfortunately, for a working mouse and keyboard via Sunshine I need to use the libinput backend for sway and that requires interaction with /dev/input devices. I want to avoid privileged: true as a setting. I have handed /dev/uinput as a device into the pod via this plugin, and Sunshine creates its input devices dynamically via it.

That means I need dynamic access to /dev/input in the container, because the input devices don't exist at container creation. I've tired a couple of configurations along the lines of

            - --device
            - |
              name: input
              groups:
                - paths:
                    - path: /dev/input

            - --device
            - |
              name: input
              groups:
                - paths:
                    - path: /dev/input/*
                      mountPath: /dev/input

But it looks like the container only has access to pre-existing entries in /dev/input with e.g. the first option. The second option bumps the count to something like 18, but then it tries to mount devices that no longer exists. Is that a limitation of device plugins as a whole perhaps? Is there a way to do this with generic-device-plugin at all?

[squat]

Hi @embik I think this should be possible using something like:

            - --device
            - |
              name: input
              groups:
                - paths:
                    - path: /dev/input
                      type: mount

This will cause the entire /dev/input directory to be bind-mounted into the your container rather than passed as a device, which should allow your container to see new devices that are created dynamically after the container starts.

Can you give that a shot and let me know if it works?

[squat]

If that works, then you could also be fancy and group uinput and input so they are passed to the container as a single composite device:

            - --device
            - |
              name: input
              groups:
                - paths:
                    - path: /dev/uinput
                    - path: /dev/input
                      type: mount

[embik]

Thanks for the quick response! I tried that out, but it looks like /dev/input isn't mounted at all:

$  k exec -it steam-0 -- bash -c "ls -lisah /dev/*input*"
12 0 crw-rw---- 1 root messagebus 10, 223 Jan 12 21:01 /dev/uinput

This is my pod resources:

$  k get pod steam-0 -o jsonpath="{.spec.containers[0].resources}" | jq .
{
  "limits": {
    "amd.com/gpu": "1",
    "embik.me/fuse": "1",
    "embik.me/input": "1",
    "embik.me/tty": "1",
    "embik.me/uinput": "1",
    "memory": "32G"
  },
  "requests": {
    "amd.com/gpu": "1",
    "cpu": "1",
    "embik.me/fuse": "1",
    "embik.me/input": "1",
    "embik.me/tty": "1",
    "embik.me/uinput": "1",
    "memory": "4G"
  }
}

And this is my configuration:

        - image: docker.io/squat/generic-device-plugin:cf81aac
          args:
            - --domain
            - embik.me
            - --device
            - |
              name: tty
              groups:
                - paths:
                    - path: /dev/tty0
                    - path: /dev/tty1
            - --device
            - |
              name: fuse
              groups:
                - count: 10
                  paths:
                    - path: /dev/fuse
            - --device
            - |
              name: uinput
              groups:
                - paths:
                    - path: /dev/uinput
            - --device
            - |
              name: input
              groups:
                - paths:
                    - path: /dev/input
                      type: mount

Could this be a bug? Is there anything else I can provide if it is a bug?

[squat]

Hmmm weird, that kind of seems like a bug to me. The directory /dev/input definitely exists on the host before the container starts, right?

[embik]

Yes, definitely, it's there (when I was using /dev/input/* from the original post, I got those preexisting devices mounted into the container, just nothing new).

[squat]

thanks, I'll investigate then because this should work IMO. Maybe gdp is only discovering and bind mounting non-directories for some reason.

[squat]

Weird, tests pass in #149. There must be something else going on because GDP is correctly passing the mount information to the kubelet. I'll dig some more.

[embik]

Thanks for looking into it more! If GDP does everything correctly, it might simply be a limitation on the kubelet side. Please don't spend too much time :-)