cgroups/systemd/apply_systemd.go
func joinDevices(c *configs.Cgroup, pid int) error {
	path, err := join(c, "devices", pid)
	// Even if it's `not found` error, we'll return err because devices cgroup
	// is hard requirement for container security.
	if err != nil {
		return err
	}

	devices := subsystems["devices"]
	return devices.Set(path, c)
}
func joinDevices(c *configs.Cgroup, pid int) error {
	path, err := join(c, "devices", pid)
	// Even if it's `not found` error, we'll return err because devices cgroup
	// is hard requirement for container security.
	if err != nil {
		return err
	}

	devices := subsystems["devices"]
	return devices.Set(path, c)
}
func joinDevices ( c * configs . Cgroup , pid int ) error { path , err := join ( c , " " , pid ) // Even if it's `not found` error, we'll return err because devices cgroup // is hard requirement for container security. if err != nil { return err } devices := subsystems [ " " ] return devices . Set ( path , c ) }
// Atm we can't use the systemd device support because of two missing things:
// * Support for wildcards to allow mknod on any device
// * Support for wildcards to allow /dev/pts support
//
// The second is available in more recent systemd as "char-pts", but not in e.g. v208 which is
// in wide use. When both these are available we will be able to switch, but need to keep the old
// implementation for backwards compat.
//
// Note: we can't use systemd to set up the initial limits, and then change the cgroup
// because systemd will re-write the device settings if it needs to re-apply the cgroup context.
// This happens at least for v208 when any sibling unit is started.
Atm we can t use the systemd device support because of two missing things : * Support for wildcards to allow mknod on any device * Support for wildcards to allow / dev / pts support The second is available in more recent systemd as char - pts but not in e . g . v208 which is in wide use . When both these are available we will be able to switch but need to keep the old implementation for backwards compat . Note : we can t use systemd to set up the initial limits and then change the cgroup because systemd will re - write the device settings if it needs to re - apply the cgroup context . This happens at least for v208 when any sibling unit is started .