Question: What is the equivalent of writing input into `devices.allow`?

[allfro]

Hi there,

Apologies if this question is in the wrong place. I am trying to write a docker plugin which adds entries into devices.allow. I've successfully made it work using cgroup v1 by simply writing to the file exposed under /sys/fs/devices/docker/<cid>/devices.allow. However, in newer versions of Linux using cgroup v2, that option is no longer feasible. What is the equivalent in cgroup v2? How do I add an entry to the equivalent of devices.allow using this library?

Thanks in advance!

[dcantah]

@allfro Fairly sure it'd be through the generic Update method on the Manager.

cgroups/cgroup2/manager.go

Line 257 in fc3b020

func (c *Manager) Update(resources *Resources) error {

Resources has a Device field that is a slice of OCI runtime spec LinuxDeviceCgroup's that has an Allow field