Support for Mac USB Passthrough on Yubikey (or other USB TPM devices)

[hongkongkiwi]

Is your feature request related to a problem? Please describe.

I need to pass through USB TPM devices (e.g. Yubikey) into a docker container. USB passthrough support for mac was added into Hyperkit, but currently this is not supported by Docker for mac.

This is a feature I (and others) desperately need in order to support using USB TPM devices in docker containers. Another usecase for this is crypto key storage devices being able to be used inside docker.

On Linux this can be done with this method..

There have been quite a few posts about this, but docker seems uninterested to implement it on their mac app.

The feature is available in hyperkit now.

Describe the solution you'd like
I should be able to use Mac USB devices inside a docker container with a flag.

Describe alternatives you've considered
There is no alternative.

Additional context
Many companies use hardware USB devices for code signing and private key storage. This would be a big advantage that Orbstack has over docker desktop if it's implemented.

[hongkongkiwi]

Related to #43 (but I don't think it's a duplicate as this is for USB TPM devices like Yubikey not serial devices).

[kdrag0n]

Interesting use case. Duplicate of #43 as all USB devices are more or less the same in terms of implementation.

[hongkongkiwi]

I don't believe so as serial devices can already be passed through on Mac by simply mounting the /dev/tty.XXX device into the docker container with is some use cases mentioned in the above ticket.

USB devices such as yubikey require a slightly different approach as mac doesn't expose those devices in the same way as linux (unlike serial devices).

Specifically with these docker mounts on linux:

    -v /dev/bus/usb:/dev/bus/usb \
    -v /sys/bus/usb/:/sys/bus/usb/ \
    -v /sys/devices/:/sys/devices/ \
    -v /dev/hidraw12/:/dev/hidraw12/ \
    --privileged \

[kdrag0n]

Yeah, mounting /dev/tty* like that isn't really USB passthrough. Real USB passthrough (#43) applies to all devices.