code: func joinDevices(c *configs.Cgroup, pid int) error {
  	path, err := join(c, "devices", pid)
  	// Even if it's `not found` error, we'll return err because devices cgroup
  	// is hard requirement for container security.
  	if err != nil {
  		return err
  	}
  
  	devices := subsystems["devices"]
  	return devices.Set(path, c)
  }
docs: // Atm we can't use the systemd device support because of two missing things:
  // * Support for wildcards to allow mknod on any device
  // * Support for wildcards to allow /dev/pts support
  //
  // The second is available in more recent systemd as "char-pts", but not in e.g. v208 which is
  // in wide use. When both these are available we will be able to switch, but need to keep the old
  // implementation for backwards compat.
  //
  // Note: we can't use systemd to set up the initial limits, and then change the cgroup
  // because systemd will re-write the device settings if it needs to re-apply the cgroup context.
  // This happens at least for v208 when any sibling unit is started.