To be able to adjust device permissions at runtime, this issue seeks to implement support for Linux Device CGroup updates. It is a prerequisite to get such support in Moby/Docker, see also moby/moby#42255.

Currently supplying devices to runc update --resources - does not adjust cgroup(v2) device permissions for an existing container. Some issues with device updates have been outlined in #2366 and addressed in various PRs linked to that issue.

To implement support updates would need to pass devices to the internal config.Cgroups.Resources.Devices structure. Besides update also sets config.Cgroups.SkipDevices to false explicitly, which probably would need changing.

I guess the semantics of update would need to be defined exactly. A simplistic approach would be to implement a behavior similar to what CreateCgroupConfig implements: Clear the current list of devices, append the list provided by the update command, then append the defaultDevs.

In PR #2951 @cyphar added a comment saying:

	# Unfortunately we can't update device rules directly with runc ("runc
	# update" doesn't support it, and adding support would require ironing out
	# some long-standing design issues with device configuration). So instead
	# we just run "runc update" many times, relying on the fact that runc will
	# re-apply devices cgroup rules on each runc update.

What are those design issues exactly?