Right now in the lxc template they are not allowed : https://github.com/dotcloud/docker/blob/master/daemon/execdriver/lxc/lxc_template.go#L77 and not created anywhere either.

In the fs backend of libcontainer they are not allowed: https://github.com/dotcloud/docker/blob/master/pkg/libcontainer/cgroups/fs/devices.go#L42

Nor in the systemd backend of libcontainer: https://github.com/dotcloud/docker/blob/master/pkg/libcontainer/cgroups/systemd/apply_systemd.go#L132

However, with libcontainter fuse is optionally created(which is just weird, given that cgroups doesn't allow them.) : https://github.com/dotcloud/docker/blob/3d78c49aab0829e6c3bcf63b2d7b2d162d11a11e/daemon/execdriver/native/template/default_template.go#L38

So which should it be.  Should I allow these devices and try creating them.  Allow them, but not try to create them.  Or should I disallow them?