code: func createDevices(config *configs.Config) error {
  	oldMask := syscall.Umask(0000)
  	for _, node := range config.Devices {
  		// containers running in a user namespace are not allowed to mknod
  		// devices so we can just bind mount it from the host.
  		if err := createDeviceNode(config.Rootfs, node, config.Namespaces.Contains(configs.NEWUSER)); err != nil {
  			syscall.Umask(oldMask)
  			return err
  		}
  	}
  	syscall.Umask(oldMask)
  	return nil
  }
docs: // Create the device nodes in the container.