When vendoring runC v0.0.8 into Docker, the following error happens:

docker: Error response from daemon: Cannot start container f4f299909554101cb523da3c3fa17c21204ce2a23807023a4b46dc0a1b235e09: [10] System error: write /sys/fs/cgroup/devices/devices.deny: invalid argument.

This is caused by (*DevicesGroup).Set gets given the wrong path (/sys/fs/cgroup/devices as opposed to the container's cgroups). I'm investigating this.