Support --device-cgroup-rule

[agners]

/kind feature

Description

Support the --device-cgroup-rule flag to add rules to cgroup what devices are allowed. This is useful when devices appear after the container has been started.

[rhatdan]

       --device-cgroup-rule="type major:minor mode"
          Add a rule to the cgroup allowed devices list. The rule is expected to be in the format specified in the Linux kernel documentation (Documentation/cgroup-v1/devices.txt):
            - type: a (all), c (char), or b (block);
            - major and minor: either a number, or * for all;
            - mode: a composition of r (read), w (write), and m (mknod(2)).

[rhatdan]

@giuseppe WDYT?

[giuseppe]

I think this is a good idea.

@agners would you like to open a PR for adding this feature? I can guide you through it if you hit any blocker

[agners]

@giuseppe sounds tempting... But then, I do have no go experience, and I fear that this is a rabbit hole which takes more time than want I want to spend right now :-)

[rhatdan]

Thanks @agners anyways, we will hopefully get somone working on this.

[rhatdan]

@QiWang19 PTAL