code: func WithDevices(daemon *Daemon, c *container.Container) coci.SpecOpts {
  	return func(ctx context.Context, _ coci.Client, _ *containers.Container, s *coci.Spec) error {
  		// Build lists of devices allowed and created within the container.
  		var devs []specs.LinuxDevice
  		devPermissions := s.Linux.Resources.Devices
  		if c.HostConfig.Privileged && !rsystem.RunningInUserNS() {
  			hostDevices, err := devices.HostDevices()
  			if err != nil {
  				return err
  			}
  			for _, d := range hostDevices {
  				devs = append(devs, oci.Device(d))
  			}
  			devPermissions = []specs.LinuxDeviceCgroup{
  				{
  					Allow:  true,
  					Access: "rwm",
  				},
  			}
  		} else {
  			for _, deviceMapping := range c.HostConfig.Devices {
  				d, dPermissions, err := oci.DevicesFromPath(deviceMapping.PathOnHost, deviceMapping.PathInContainer, deviceMapping.CgroupPermissions)
  				if err != nil {
  					return err
  				}
  				devs = append(devs, d...)
  				devPermissions = append(devPermissions, dPermissions...)
  			}
  
  			var err error
  			devPermissions, err = oci.AppendDevicePermissionsFromCgroupRules(devPermissions, c.HostConfig.DeviceCgroupRules)
  			if err != nil {
  				return err
  			}
  		}
  
  		s.Linux.Devices = append(s.Linux.Devices, devs...)
  		s.Linux.Resources.Devices = devPermissions
  
  		for _, req := range c.HostConfig.DeviceRequests {
  			if err := daemon.handleDevice(req, s); err != nil {
  				return err
  			}
  		}
  		return nil
  	}
  }
docs: // WithDevices sets the container's devices