Support LinuxDeviceCgroup updates

[agners]

To be able to adjust device permissions at runtime, this issue seeks to implement support for Linux Device CGroup updates. It is a prerequisite to get such support in Moby/Docker, see also moby/moby#42255.

Currently supplying devices to runc update --resources - does not adjust cgroup(v2) device permissions for an existing container. Some issues with device updates have been outlined in #2366 and addressed in various PRs linked to that issue.

To implement support updates would need to pass devices to the internal config.Cgroups.Resources.Devices structure. Besides update also sets config.Cgroups.SkipDevices to false explicitly, which probably would need changing.

I guess the semantics of update would need to be defined exactly. A simplistic approach would be to implement a behavior similar to what CreateCgroupConfig implements: Clear the current list of devices, append the list provided by the update command, then append the defaultDevs.

In PR #2951 @cyphar added a comment saying:

	# Unfortunately we can't update device rules directly with runc ("runc
	# update" doesn't support it, and adding support would require ironing out
	# some long-standing design issues with device configuration). So instead
	# we just run "runc update" many times, relying on the fact that runc will
	# re-apply devices cgroup rules on each runc update.

What are those design issues exactly?

[utam0k]

FYI: containerd recently added support for it.
containerd/cgroups#225

[agners]

@utam0k hm, that is the containerd API basically allowing to update using a Resource object correct? I guess it still requires the runc changes to make the device part actually work.

[utam0k]

@agners As far as I know, containerd has its own device emulate. I guess it use own devices emulate to update resources. If I am wrong, please let me 🙏

[agners]

@utam0k from what I understand containerd uses runc as low-level runtime by default. I don't think it has a built-in low level runtime, it requires runc to work (see https://github.com/containerd/containerd/blob/main/BUILDING.md#runc). It seems to support alternative runtimes such as crun.

[utam0k]

@agners That's right. But containerd has its own cgroup controller. Actually contained can update devices in cgv1.
https://github.com/containerd/cgroups