Add --devices flag to bud and from

Some Dockerfiles (fuse-overlay) require additional devices to be in the
build environment.

This patch allows the user to specify additional devices.

Also I noticed that CapAdd and CapDrop was not working in buildah bud situations,
so this patch also fixes this.

Signed-off-by: Daniel J Walsh <[email protected]>

Closes: containers#1820
Approved by: @TomSweeneyRedHat

Makefile

@@ -27,7 +27,8 @@ SOURCE_DATE_EPOCH ?= $(if $(shell date +%s),$(shell date +%s),$(error "date fail
 STATIC_STORAGETAGS = "containers_image_ostree_stub containers_image_openpgp exclude_graphdriver_devicemapper $(STORAGE_TAGS)"
 
 CNI_COMMIT := $(shell sed -n 's;\tgithub.com/containernetworking/cni \([^ \n]*\).*$\;\1;p' go.mod)
-RUNC_COMMIT := $(shell sed -n 's;\tgithub.com/opencontainers/runc \([^ \n]*\).*$\;\1;p' go.mod)
+#RUNC_COMMIT := $(shell sed -n 's;\tgithub.com/opencontainers/runc \([^ \n]*\).*$\;\1;p' go.mod)
+RUNC_COMMIT := v1.0.0-rc8
 LIBSECCOMP_COMMIT := release-2.3
 
 EXTRALDFLAGS :=

buildah.go

@@ -16,6 +16,7 @@ import (
  "github.com/containers/storage"
  "github.com/containers/storage/pkg/ioutils"
  v1 "github.com/opencontainers/image-spec/specs-go/v1"
+ "github.com/opencontainers/runc/libcontainer/configs"
  "github.com/pkg/errors"
  "github.com/sirupsen/logrus"
 )
@@ -188,8 +189,7 @@ type Builder struct {
  // committed image after the history item for the layer that we're
  // committing.
  AppendedEmptyLayers []v1.History
-
- CommonBuildOpts *CommonBuildOptions
+ CommonBuildOpts *CommonBuildOptions
  // TopLayer is the top layer of the image
  TopLayer string
  // Format for the build Image
@@ -198,6 +198,8 @@ type Builder struct {
  TempVolumes map[string]bool
  // ContentDigester counts the digest of all Add()ed content
  ContentDigester CompositeDigester
+ // Devices are the additional devices to add to the containers
+ Devices []configs.Device
 }
 
 // BuilderInfo are used as objects to display container information
@@ -228,6 +230,7 @@ type BuilderInfo struct {
  AddCapabilities []string
  DropCapabilities []string
  History []v1.History
+ Devices []configs.Device
 }
 
 // GetBuildInfo gets a pointer to a Builder object and returns a BuilderInfo object from it.
@@ -272,6 +275,7 @@ func GetBuildInfo(b *Builder) BuilderInfo {
  AddCapabilities: append([]string{}, b.AddCapabilities...),
  DropCapabilities: append([]string{}, b.DropCapabilities...),
  History: history,
+ Devices: b.Devices,
  }
 }
 
@@ -406,6 +410,8 @@ type BuilderOptions struct {
  CommonBuildOpts *CommonBuildOptions
  // Format for the container image
  Format string
+ // Devices are the additional devices to add to the containers
+ Devices []configs.Device
 }
 
 // ImportOptions are used to initialize a Builder from an existing container

cmd/buildah/bud.go

@@ -9,6 +9,7 @@ import (
  "github.com/containers/buildah/imagebuildah"
  buildahcli "github.com/containers/buildah/pkg/cli"
  "github.com/containers/buildah/pkg/parse"
+ "github.com/opencontainers/runc/libcontainer/configs"
  "github.com/pkg/errors"
  "github.com/sirupsen/logrus"
  "github.com/spf13/cobra"
@@ -263,6 +264,15 @@ func budCmd(c *cobra.Command, inputArgs []string, iopts budResults) error {
  transientMounts = append(transientMounts, imagebuildah.Mount(mount))
  }
 
+ devices := []configs.Device{}
+ for _, device := range iopts.Devices {
+ dev, err := parse.DeviceFromPath(device)
+ if err != nil {
+ return err
+ }
+ devices = append(devices, dev)
+ }
+
  options := imagebuildah.BuildOptions{
  ContextDirectory: contextDir,
  PullPolicy: pullPolicy,
@@ -301,6 +311,7 @@ func budCmd(c *cobra.Command, inputArgs []string, iopts budResults) error {
  BlobDirectory: iopts.BlobCache,
  Target: iopts.Target,
  TransientMounts: transientMounts,
+ Devices: devices,
  }
 
  if iopts.Quiet {

cmd/buildah/from.go

@@ -9,6 +9,7 @@ import (
  "github.com/containers/buildah"
  buildahcli "github.com/containers/buildah/pkg/cli"
  "github.com/containers/buildah/pkg/parse"
+ "github.com/opencontainers/runc/libcontainer/configs"
  "github.com/pkg/errors"
  "github.com/sirupsen/logrus"
  "github.com/spf13/cobra"
@@ -211,6 +212,15 @@ func fromCmd(c *cobra.Command, args []string, iopts fromReply) error {
  return err
  }
 
+ devices := []configs.Device{}
+ for _, device := range iopts.Devices {
+ dev, err := parse.DeviceFromPath(device)
+ if err != nil {
+ return err
+ }
+ devices = append(devices, dev)
+ }
+
  options := buildah.BuilderOptions{
  FromImage: args[0],
  Container: iopts.name,
@@ -229,6 +239,7 @@ func fromCmd(c *cobra.Command, args []string, iopts fromReply) error {
  CommonBuildOpts: commonOpts,
  Format: format,
  BlobDirectory: iopts.BlobCache,
+ Devices: devices,
  }
 
  if !iopts.quiet {

contrib/completions/bash/buildah

@@ -389,6 +389,7 @@ return 1
  --cpuset-cpus
  --cpuset-mems
  --creds
+ --device
  --dns-search
  --dns
  --dns-option
@@ -853,6 +854,7 @@ _buildah_containers() {
  --cpuset-cpus
  --cpuset-mems
  --creds
+ --device
  --http-proxy
  --ipc
  --isolation

docs/buildah-bud.md

@@ -172,8 +172,11 @@ The [username[:password]] to use to authenticate with the registry if required.
 If one or both values are not supplied, a command line prompt will appear and the
 value can be entered. The password is entered without echo.
 
-**--disable-compression, -D**
+**--device**=*device*
+
+Add a host device to the container. The format is `<device-on-host>[:<device-on-container>][:<permissions>]` (e.g. --device=/dev/sdc:/dev/xvdc:rwm)
 
+**--disable-compression, -D**
 Don't compress filesystem layers when building the image unless it is required
 by the location where the image is being written. This is the default setting,
 because image layers are compressed automatically when they are pushed to

docs/buildah-from.md

@@ -171,6 +171,10 @@ The [username[:password]] to use to authenticate with the registry if required.
 If one or both values are not supplied, a command line prompt will appear and the
 value can be entered. The password is entered without echo.
 
+**--device**=*device*
+
+Add a host device to the container. The format is `<device-on-host>[:<device-on-container>][:<permissions>]` (e.g. --device=/dev/sdc:/dev/xvdc:rwm)
+
 **--dns**=[]
 
 Set custom DNS servers

go.mod

@@ -5,10 +5,13 @@ go 1.12
 require (
  github.com/VividCortex/ewma v1.1.1 // indirect
  github.com/blang/semver v3.5.0+incompatible // indirect
+ github.com/checkpoint-restore/go-criu v0.0.0-20190109184317-bdb7599cd87b // indirect
+ github.com/containerd/console v0.0.0-20181022165439-0650fd9eeb50 // indirect
  github.com/containerd/continuity v0.0.0-20181203112020-004b46473808 // indirect
  github.com/containernetworking/cni v0.7.1
  github.com/containers/image v3.0.2+incompatible
  github.com/containers/storage v1.13.2
+ github.com/coreos/go-systemd v0.0.0-20190719114852-fd7a80b32e1f // indirect
  github.com/cyphar/filepath-securejoin v0.2.1
  github.com/docker/distribution v0.0.0-20170817175659-5f6282db7d65
  github.com/docker/docker-credential-helpers v0.6.1 // indirect
@@ -25,12 +28,13 @@ require (
  github.com/mattn/go-isatty v0.0.4 // indirect
  github.com/mattn/go-shellwords v1.0.5
  github.com/moby/moby v0.0.0-20171005181806-f8806b18b4b9 // indirect
+ github.com/mrunalp/fileutils v0.0.0-20171103030105-7d4729fb3618 // indirect
  github.com/mtrmac/gpgme v0.0.0-20170102180018-b2432428689c // indirect
  github.com/onsi/ginkgo v1.8.0
  github.com/onsi/gomega v1.5.0
  github.com/opencontainers/go-digest v1.0.0-rc1
  github.com/opencontainers/image-spec v1.0.1
- github.com/opencontainers/runc v1.0.0-rc8
+ github.com/opencontainers/runc v1.0.0-rc8.0.20190827142921-dd075602f158
  github.com/opencontainers/runtime-spec v0.1.2-0.20190618234442-a950415649c7
  github.com/opencontainers/runtime-tools v0.9.0
  github.com/opencontainers/selinux v1.2.2
@@ -42,8 +46,10 @@ require (
  github.com/sirupsen/logrus v1.4.2
  github.com/spf13/cobra v0.0.3
  github.com/spf13/pflag v1.0.3
+ github.com/stretchr/testify v1.3.0
  github.com/syndtr/gocapability v0.0.0-20180916011248-d98352740cb2
  github.com/ulikunitz/xz v0.5.5 // indirect
+ github.com/urfave/cli v1.21.0 // indirect
  github.com/vbauerster/mpb v3.4.0+incompatible // indirect
  github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f // indirect
  github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect

go.sum

@@ -23,6 +23,8 @@ github.com/VividCortex/ewma v1.1.1 h1:MnEK4VOv6n0RSY4vtRe3h11qjxL3+t0B8yOL8iMXdc
 github.com/VividCortex/ewma v1.1.1/go.mod h1:2Tkkvm3sRDVXaiyucHiACn4cqf7DpdyLvmxzcbUokwA=
 github.com/blang/semver v3.5.0+incompatible h1:CGxCgetQ64DKk7rdZ++Vfnb1+ogGNnB17OJKJXD2Cfs=
 github.com/blang/semver v3.5.0+incompatible/go.mod h1:kRBLl5iJ+tD4TcOOxsy/0fnwebNt5EWlYSAyrTnjyyk=
+github.com/checkpoint-restore/go-criu v0.0.0-20190109184317-bdb7599cd87b/go.mod h1:TrMrLQfeENAPYPRsJuq3jsqdlRh3lvi6trTZJG8+tho=
+github.com/containerd/console v0.0.0-20181022165439-0650fd9eeb50/go.mod h1:Tj/on1eG8kiEhd0+fhSDzsPAFESxzBBvdyEgyryXffw=
 github.com/containerd/continuity v0.0.0-20180814194400-c7c5070e6f6e/go.mod h1:GL3xCUCBDV3CZiTSEKksMWbLE66hEyuu9qyDOOqM47Y=
 github.com/containerd/continuity v0.0.0-20181203112020-004b46473808 h1:4BX8f882bXEDKfWIf0wa8HRvpnBoPszJJXL+TVbBw4M=
 github.com/containerd/continuity v0.0.0-20181203112020-004b46473808/go.mod h1:GL3xCUCBDV3CZiTSEKksMWbLE66hEyuu9qyDOOqM47Y=
@@ -54,10 +56,12 @@ github.com/containers/storage v1.13.1 h1:rjVirLS9fCGkUFlLDZEoGDDUugtIf46DufWvJu0
 github.com/containers/storage v1.13.1/go.mod h1:6D8nK2sU9V7nEmAraINRs88ZEscM5C5DK+8Npp27GeA=
 github.com/containers/storage v1.13.2 h1:UXZ0Ckmk6+6+4vj2M2ywruVtH97pnRoAhTG8ctd+yQI=
 github.com/containers/storage v1.13.2/go.mod h1:6D8nK2sU9V7nEmAraINRs88ZEscM5C5DK+8Npp27GeA=
+github.com/coreos/go-systemd v0.0.0-20190719114852-fd7a80b32e1f/go.mod h1:F5haX7vjVVG0kc13fIWeqUViNPyEJxv/OmvnBo0Yme4=
 github.com/cyphar/filepath-securejoin v0.2.1 h1:5DPkzz/0MwUpvR4fxASKzgApeq2OMFY5FfYtrX28Coo=
 github.com/cyphar/filepath-securejoin v0.2.1/go.mod h1:FpkQEhXnPnOthhzymB7CGsFk2G9VLXONKD9G7QGMM+4=
 github.com/davecgh/go-spew v0.0.0-20151105211317-5215b55f46b2/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/docker/distribution v0.0.0-20170817175659-5f6282db7d65 h1:4zlOyrJUbYnrvlzChJ+jP2J3i77Jbhm336NEuCv7kZo=
 github.com/docker/distribution v0.0.0-20170817175659-5f6282db7d65/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
@@ -160,6 +164,7 @@ github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJ
 github.com/modern-go/reflect2 v0.0.0-20180320133207-05fbef0ca5da/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
 github.com/modern-go/reflect2 v0.0.0-20180701023420-4b7aa43c6742/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
 github.com/modern-go/reflect2 v1.0.1/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
+github.com/mrunalp/fileutils v0.0.0-20171103030105-7d4729fb3618/go.mod h1:x8F1gnqOkIEiO4rqoeEEEqQbo7HjGMTvyoq3gej4iT0=
 github.com/mtrmac/gpgme v0.0.0-20170102180018-b2432428689c h1:xa+eQWKuJ9MbB9FBL/eoNvDFvveAkz2LQoz8PzX7Q/4=
 github.com/mtrmac/gpgme v0.0.0-20170102180018-b2432428689c/go.mod h1:GhAqVMEWnTcW2dxoD/SO3n2enrgWl3y6Dnx4m59GvcA=
 github.com/munnerz/goautoneg v0.0.0-20120707110453-a547fc61f48d/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
@@ -182,6 +187,8 @@ github.com/opencontainers/image-spec v1.0.1/go.mod h1:BtxoFyWECRxE4U/7sNtV5W15zM
 github.com/opencontainers/runc v0.1.1/go.mod h1:qT5XzbpPznkRYVz/mWwUaVBUv2rmF59PVA73FjuZG0U=
 github.com/opencontainers/runc v1.0.0-rc8 h1:dDCFes8Hj1r/i5qnypONo5jdOme/8HWZC/aNDyhECt0=
 github.com/opencontainers/runc v1.0.0-rc8/go.mod h1:qT5XzbpPznkRYVz/mWwUaVBUv2rmF59PVA73FjuZG0U=
+github.com/opencontainers/runc v1.0.0-rc8.0.20190827142921-dd075602f158 h1:/A6bAdnSZoTQmKml3MdHAnSEPnBAQeigNBl4sxnfaaQ=
+github.com/opencontainers/runc v1.0.0-rc8.0.20190827142921-dd075602f158/go.mod h1:qT5XzbpPznkRYVz/mWwUaVBUv2rmF59PVA73FjuZG0U=
 github.com/opencontainers/runtime-spec v0.1.2-0.20190618234442-a950415649c7 h1:Dliu5QO+4JYWu/yMshaMU7G3JN2POGpwjJN7gjy10Go=
 github.com/opencontainers/runtime-spec v0.1.2-0.20190618234442-a950415649c7/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
 github.com/opencontainers/runtime-tools v0.9.0 h1:FYgwVsKRI/H9hU32MJ/4MLOzXWodKK5zsQavY8NPMkU=
@@ -201,6 +208,7 @@ github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINE
 github.com/pkg/errors v0.8.1 h1:iURUrRGxPUNPdy5/HRSm+Yj6okJ6UtLINN0Q9M4+h3I=
 github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v0.0.0-20151028094244-d8ed2627bdf0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pquerna/ffjson v0.0.0-20171002144729-d49c2bc1aa13 h1:AUK/hm/tPsiNNASdb3J8fySVRZoI7fnK5mlOvdFD43o=
 github.com/pquerna/ffjson v0.0.0-20171002144729-d49c2bc1aa13/go.mod h1:YARuvh7BUWHNhzDq2OM5tzR2RiCcN2D7sapiKyCel/M=
@@ -222,6 +230,7 @@ github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+
 github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/testify v0.0.0-20151208002404-e3a8ff8ce365/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
+github.com/stretchr/testify v1.3.0 h1:TivCn/peBQ7UY8ooIcPgZFpTNSz0Q2U6UrFlUfqbe0Q=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/syndtr/gocapability v0.0.0-20180916011248-d98352740cb2 h1:b6uOv7YOFK0TYG7HtkIgExQo+2RdLuwRft63jn2HWj8=
 github.com/syndtr/gocapability v0.0.0-20180916011248-d98352740cb2/go.mod h1:hkRG7XYTFWNJGYcbNJQlaLq0fg1yr4J4t/NcTQtrfww=
@@ -231,6 +240,7 @@ github.com/tchap/go-patricia v2.3.0+incompatible h1:GkY4dP3cEfEASBPPkWd+AmjYxhmD
 github.com/tchap/go-patricia v2.3.0+incompatible/go.mod h1:bmLyhP68RS6kStMGxByiQ23RP/odRBOTVjwp2cDyi6I=
 github.com/ulikunitz/xz v0.5.5 h1:pFrO0lVpTBXLpYw+pnLj6TbvHuyjXMfjGeCwSqCVwok=
 github.com/ulikunitz/xz v0.5.5/go.mod h1:2bypXElzHzzJZwzH67Y6wb67pO62Rzfn7BSiF4ABRW8=
+github.com/urfave/cli v1.21.0/go.mod h1:lxDj6qX9Q6lWQxIrbrT0nwecwUtRnhVZAJjJZrVUZZQ=
 github.com/vbatts/tar-split v0.10.2 h1:CXd7HEKGkTLjBMinpObcJZU5Hm8EKlor2a1JtX6msXQ=
 github.com/vbatts/tar-split v0.10.2/go.mod h1:LEuURwDEiWjRjwu46yU3KVGuUdVv/dcnpcEPSzR8z6g=
 github.com/vbatts/tar-split v0.11.1 h1:0Odu65rhcZ3JZaPHxl7tCI3V/C/Q9Zf82UFravl02dE=

imagebuildah/build.go

@@ -17,6 +17,7 @@ import (
  "github.com/containers/image/types"
  "github.com/containers/storage"
  "github.com/containers/storage/pkg/archive"
+ "github.com/opencontainers/runc/libcontainer/configs"
  "github.com/opencontainers/runtime-spec/specs-go"
  "github.com/openshift/imagebuilder"
  "github.com/pkg/errors"
@@ -156,6 +157,8 @@ type BuildOptions struct {
  BlobDirectory string
  // Target the targeted FROM in the Dockerfile to build
  Target string
+ // Devices are the additional devices to add to the containers
+ Devices []configs.Device
 }
 
 // BuildDockerfiles parses a set of one or more Dockerfiles (which may be

imagebuildah/executor.go

@@ -20,6 +20,7 @@ import (
  "github.com/containers/storage"
  "github.com/containers/storage/pkg/archive"
  v1 "github.com/opencontainers/image-spec/specs-go/v1"
+ "github.com/opencontainers/runc/libcontainer/configs"
  "github.com/openshift/imagebuilder"
  "github.com/openshift/imagebuilder/dockerfile/parser"
  "github.com/pkg/errors"
@@ -90,6 +91,9 @@ type Executor struct {
  excludes []string
  unusedArgs map[string]struct{}
  buildArgs map[string]string
+ addCapabilities []string
+ dropCapabilities []string
+ devices []configs.Device
 }
 
 // NewExecutor creates a new instance of the imagebuilder.Executor interface.
@@ -144,6 +148,9 @@ func NewExecutor(store storage.Store, options BuildOptions, mainNode *parser.Nod
  blobDirectory: options.BlobDirectory,
  unusedArgs: make(map[string]struct{}),
  buildArgs: options.Args,
+ addCapabilities: options.AddCapabilities,
+ dropCapabilities: options.DropCapabilities,
+ devices: options.Devices,
  }
  if exec.err == nil {
  exec.err = os.Stderr

imagebuildah/stage_executor.go

@@ -585,6 +585,9 @@ func (s *StageExecutor) prepare(ctx context.Context, stage imagebuilder.Stage, f
  CommonBuildOpts: s.executor.commonBuildOptions,
  DefaultMountsFilePath: s.executor.defaultMountsFilePath,
  Format: s.executor.outputFormat,
+ AddCapabilities: s.executor.addCapabilities,
+ DropCapabilities: s.executor.dropCapabilities,
+ Devices: s.executor.devices,
  }
 
  // Check and see if the image is a pseudonym for the end result of a

new.go

@@ -360,6 +360,7 @@ func newBuilder(ctx context.Context, store storage.Store, options BuilderOptions
  Args: options.Args,
  Format: options.Format,
  TempVolumes: map[string]bool{},
+ Devices: options.Devices,
  }
 
  if options.Mount {

pkg/cli/common.go

@@ -87,6 +87,7 @@ type FromAndBudResults struct {
  CPUSetCPUs string
  CPUSetMems string
  CPUShares uint64
+ Devices []string
  DNSSearch []string
  DNSServers []string
  DNSOptions []string
@@ -185,6 +186,7 @@ func GetFromAndBudFlags(flags *FromAndBudResults, usernsResults *UserNSResults,
  fs.Uint64VarP(&flags.CPUShares, "cpu-shares", "c", 0, "CPU shares (relative weight)")
  fs.StringVar(&flags.CPUSetCPUs, "cpuset-cpus", "", "CPUs in which to allow execution (0-3, 0,1)")
  fs.StringVar(&flags.CPUSetMems, "cpuset-mems", "", "memory nodes (MEMs) in which to allow execution (0-3, 0,1). Only effective on NUMA systems.")
+ fs.StringArrayVar(&flags.Devices, "device", []string{}, "Additional devices to be used within containers (default [])")
  fs.StringSliceVar(&flags.DNSSearch, "dns-search", []string{}, "Set custom DNS search domains")
  fs.StringSliceVar(&flags.DNSServers, "dns", []string{}, "Set custom DNS servers or disable it completely by setting it to 'none', which prevents the automatic creation of `/etc/resolv.conf`.")
  fs.StringSliceVar(&flags.DNSOptions, "dns-option", []string{}, "Set custom DNS options")