LXC / Docker containers start but cannot be attached (/dev/null, /dev/ptmx missing) on NVIDIA DRIVE AGX Thor (Ubuntu 24.04)

Autonomous Vehicles DRIVE AGX Thor DRIVE AGX Thor General
1

DRIVE OS Version: Provide DRIVE OS version. 7.0.3

Issue Description:

Platform

  • Hardware: NVIDIA DRIVE AGX Thor
  • OS: Ubuntu 24.04 (vendor BSP)
  • Kernel: NVIDIA-provided kernel (Tegra / Thor)
  • Container runtimes:
    • LXC (via lxc-create, lxc-start)
    • Docker (via docker.io)

Problem summary

Containers start successfully, networking works, init runs, and logs indicate a healthy boot.
However, interactive access to containers is impossible:

  • lxc-attach fails
  • docker exec -it fails
  • Containers are only reachable when started directly in foreground (lxc-start -F)

This blocks basic container usability (debugging, shell access, service management).

Main Questions:

1. Are there any known BSP, kernel, or hardware restrictions on DRIVE AGX Thor that intentionally prevent full container functionality (e.g., lxc-attach, docker exec, PTY support)?

2. Are there any other known limitations or constraints related to container usage on DRIVE AGX Thor (e.g., functionality, kernel features, security policies, or supported use-cases) that developers should be aware of?
If so:

  • where are these limitations documented?
  • are they configurable or fixed by design?

More details:

LXC Observed behavior

Container starts and runs:

sudo apt update
sudo apt install -y lxc lxc-templates lxc-utils uidmap
sudo lxc-create -n demo -t download -- --dist ubuntu --release jammy --arch $(dpkg --print-architecture)
#Foreground (shows logs live):
#sudo lxc-start -n demo -F
#If you want background instead:
sudo lxc-start -n demo

#console
sudo lxc-info -n demo

Output:

Name:           demo
State:          RUNNING
PID:            18479
IP:             10.0.3.165
Link:           vethUrVeeo
 TX bytes:      1.99 KiB
 RX bytes:      3.97 KiB
 Total bytes:   5.95 KiB

But attach fails:

sudo lxc-attach -n demo -- /bin/bash || sudo lxc-attach -n demo -- /bin/sh

Output:

lxc-attach: demo: open_devnull: Can't open /dev/null
lxc-attach: demo: Failed to exec "/bin/bash"
lxc-attach: demo: Failed to exec "/bin/sh"

Docker Observed behavior

Container starts normally:

sudo docker pull alpine:latest
sudo docker create --name demo alpine:latest sleep infinity

sudo docker start demo

But exec fails:

sudo docker exec -it demo /bin/sh

Output:

OCI runtime exec failed:
open /dev/ptmx: no such file or directory

Verified host state

On the host system:

ls -l /dev/null
crw-rw-rw- 1 root root 1, 3 /dev/null

mount | grep devtmpfs
none on /dev type devtmpfs (rw,relatime,size=30491404k,nr_inodes=7622851,mode=755,inode64)
none on /dev type devtmpfs (rw,relatime,size=30491404k,nr_inodes=7622851,mode=755,inode64)

Additional questions:

  1. Is full interactive container usage officially supported on DRIVE AGX Thor?
  2. Are additional kernel config options required to enable PTY/devpts and others inside containers?
  3. Is there a recommended or supported workaround?
  4. Has this behavior been previously observed or documented?
3

Dear @mykhailo.i.kozak ,
Did you check Target Container Support — NVIDIA DriveOS 7.0.3 Linux SDK Developer Guide ?

The container on the target is intended for experimental use only and has not been thoroughly tested for all features.
Could you share the used commands to repro the issue?

4

Thanks for the link and fast reply.

Is NVIDIA Container Toolkit provide access not only for GPU resources?
For now I am not fully interested in graphic acceleration, but some simple access, like attach to the docker , or access cgroup controllers from the container

Also I have updated a commands in the initial post, so the problem should be possible to reproduce

5

Were you able to analyse or reproduce the issue?
Any additional updates on how to overcome those issues?

6

Is there any restriction by NVIDIA for the usage of DEVTMPFS?
CONFIG_DEVTMPFS=y
CONFIG_DEVTMPFS_MOUNT=y

10

Regarding NVIDIA container tools, from the provided documentation LXC container does not require Architecture Overview — NVIDIA Container Toolkit

Also, is there some restriction to use LXC in “privileged” mode? Any suggestions and recommendations regarding LXC containers on NVIDIA DRIVE AGX Thor?

Is there any know restrictions to mount /dev/* inside lxc and get access to them ?

11

Dear @mykhailo.i.kozak ,
I’m closing this topic due to there is no update from you for a period, assuming this issue was resolved.
If still need the support, please open a new topic. Thanks

I could reproduce the issue when trying to use docker exec

nvidia@tegra-ubuntu:~$ sudo docker ps -a
CONTAINER ID   IMAGE          COMMAND   CREATED          STATUS          PORTS     NAMES
14b74634363a   ubuntu:24.04   "bash"    15 seconds ago   Up 14 seconds             ubuntuOS
nvidia@tegra-ubuntu:~$ sudo docker exec -it ubuntuOS bash
OCI runtime exec failed: exec failed: unable to start container process: open /dev/ptmx: no such file or directory: unknown

But I could attach to container

nvidia@tegra-ubuntu:~$ sudo docker attach 14b74634363a
root@tegra-ubuntu:/home/nvidia#

Noticed /proc/config.gz has CONFIG_DEVPTS=y and CONFIG_UNIX98_PTYS=y, so basic PTY support is present.
Noticed that devpts is mounted with ptmxmode=000 so it cannot be used to create a new PTY for docker exec -it . Did you try enable kernel config: CONFIG_DEVPTS_MULTIPLE_INSTANCES=y ? If not, could you check and update?

root@tegra-ubuntu:/home/nvidia# ls -l /dev/ptmx
mount | grep devpts
crw-rw-rw- 1 root tty 5, 2 Feb 17 16:42 /dev/ptmx
devpts on /dev/pts type devpts (rw,nosuid,noexec,relatime,gid=5,mode=620,ptmxmode=000)
devpts on /dev/console type devpts (rw,nosuid,noexec,relatime,gid=5,mode=620,ptmxmode=000)

Is it ok to use containers in foreground for your development?

12

Could you please provide any update for this topic?