Making Raspberry Pi GPIO work from an Azure IoT Edge Module - docker

Question

I have a simple example Node-RED project here on GitHub where I'm attempting to interact with a few GPIO on a Raspberry Pi running Buster. If I run that project directly on the Pi, it works fine. If I run it as a Module by deploying through Azure IoT Edge, I'm unable to interact with the same GPIO, even if I have deployed using these Container Create Options...
{
"HostConfig": {
"PortBindings": {
"1880/tcp": [
{
"HostPort": "80"
}
]
},
"Privileged": true
}
}
...from /kpmartinhfi/gpio-poc:latest on Docker Hub, built using docker buildx build --platform linux/arm/v7 -t kpmartinhfi/gpio-poc:latest . --push.
The Node-RED editor UI is avialable at :80 on the device, so it's basically working, but attempting to use GPIO gets access/permissions errors:
16 Sep 19:21:33 - [info] Starting flows
16 Sep 19:21:33 - [info] Started flows
16 Sep 19:21:33 - [info] [rpi-gpio out:Buzzer (GPIO20)] err: Traceback (most recent call last):
File "/usr/src/node-red/node_modules/#node-red/nodes/core/hardware/nrgpio.py", line 84, in <module>
:
16 Sep 19:21:33 - [info] [rpi-gpio out:Buzzer (GPIO20)] err: GPIO.setup(pin,GPIO.OUT)
RuntimeError: No access to /dev/mem. Try running as root!
:
16 Sep 19:21:33 - [info] [rpi-gpio out:Relay (GPIO26)] err: Traceback (most recent call last):
File "/usr/src/node-red/node_modules/#node-red/nodes/core/hardware/nrgpio.py", line 84, in <module>
GPIO.setup(pin,GPIO.OUT)
RuntimeError: No access to /dev/mem. Try running as root!
:
16 Sep 19:21:33 - [info] [rpi-gpio out:Buzzer (GPIO20)] closed
16 Sep 19:21:33 - [info] [rpi-gpio out:Relay (GPIO26)] closed
16 Sep 19:21:33 - [info] [rpi-gpio out:Relay (GPIO16)] err: Traceback (most recent call last):
File "/usr/src/node-red/node_modules/#node-red/nodes/core/hardware/nrgpio.py", line 84, in <module>
:
16 Sep 19:21:33 - [info] [rpi-gpio out:Relay (GPIO16)] err: GPIO.setup(pin,GPIO.OUT)
RuntimeError: No access to /dev/mem. Try running as root!
:
16 Sep 19:21:33 - [info] [rpi-gpio out:Relay (GPIO16)] closed
16 Sep 19:21:36 - [info] [rpi-gpio out:Relay (GPIO16)] out: 0
16 Sep 19:21:36 - [error] [rpi-gpio out:Relay (GPIO16)] nrpgio python command not running
16 Sep 19:21:37 - [info] [rpi-gpio out:Relay (GPIO16)] out: 1
16 Sep 19:21:37 - [error] [rpi-gpio out:Relay (GPIO16)] nrpgio python command not running
What's the best way to resolve this that doesn't leave the system in a terribly insecure state?
My attempt at using Privileged:true was meant to be a "hack" just to see things working, but I'm suspecting that that's not a good way to go to "production".
I wonder if I need to do something in the Dockerfile like add the default Node-RED user to a group with access to GPIO, but since each attempt takes quite a while to try, I thought I'd ask first. :)

Answer 1

i'm not sure if this will solve your problem exactly, but one of the things you have to do to get access to the RPI's GPIO pins from your IoT Edge module is to bind them to the module. for example, I wrote a module in python that integrates with the SenseHat accessory for IoT Edge. Like many libraries, it uses the i2c bus to talk to the GPIO pins, so I map those into my container with these "create options"
{"HostConfig":{"Binds":["/dev/i2c-1:/dev/i2c-1"],"Privileged":true}}
If that doesn't work, depending on how Node-Red accesses the pins, you can also try
{"HostConfig":{"Binds":["/dev/gpiomem:/dev/gpiomem"],"Privileged":true}}
or (and I think this is the 'share everything" approach)
{"HostConfig":{"Binds":["/sys:/sys"],"Privileged":true}}