Cannot pass folder to --device

[apostasie]

Description

nerdctl does not allow passing /dev/snd as a device - unlike docker.

I assume this issue should be fixed in nerdctl, but I would have to look into moby and figure out what they are doing.

Steps to reproduce the issue

sudo ./nerdctl run -ti --device=/dev/snd debian ls -lA /dev/snd
FATA[0000] not a device node

Describe the results you received and expected

On the same node, against the same containerd.

docker run -ti --device=/dev/snd debian ls -lA /dev/snd
total 0
crw-rw---- 1 root audio 116,  3 May 10 23:38 controlC0
crw-rw---- 1 root audio 116,  5 May 10 23:38 controlC1
crw-rw---- 1 root audio 116,  2 May 10 23:38 pcmC0D0p
crw-rw---- 1 root audio 116,  4 May 10 23:38 pcmC1D0p
crw-rw---- 1 root audio 116,  1 May 10 23:38 seq
crw-rw---- 1 root audio 116, 33 May 10 23:38 timer

What version of nerdctl are you using?

1.7.6

Are you using a variant of nerdctl? (e.g., Rancher Desktop)

None

Host information

Debian GNU/Linux 12

Raspberry Pi 3 Model B Rev 1.2

Note: the containerd I am testing against is the one shipped by docker (containerd containerd.io 1.6.31 e377cd56a71523140ca6ae87e30244719194a521).

[apostasie]

@AkihiroSuda this one is hurting me.

I will gladly author a patch, but I need some pointer as I am not quite sure where to look, so, if you can nudge me in the right direction...

[apostasie]

Ok... so...

Moby is doing this:
https://github.com/moby/moby/blob/cd08d377c5e0348984d1f46d196337d895ec47ad/oci/devices_linux.go#L24

Obviously /dev/snd is a folder, so, it enumerates devices in there.

This is called from https://github.com/moby/moby/blob/cd08d377c5e0348984d1f46d196337d895ec47ad/daemon/oci_linux.go#L888

On the other hand, it seems to me nerdctl is doing this:

nerdctl/pkg/cmd/container/run_cgroup_linux.go

Line 201 in 8eeef86

for _, f := range options.Device {

Which does not handle things the same way.

Question is: is the right approach to implement something similar here?

[AkihiroSuda]

Question is: is the right approach to implement something similar here?

Yes, nerdctl should follow Docker's approach whenever it is possible

[apostasie]

Ok.
I dislike the Moby implementation (too much duplication of code from containerd), but I will come up with something that has the same behavior (eg: allow passing a directory to --device that enumerates devices inside the directory).