<p dir="auto">We seem to have hit a requirement where we need to pass</p>
<p dir="auto">--device=[]: Allows you to run devices inside the container without the --privileged flag.</p>
<p dir="auto">Looking at  <a href="https://cloud.google.com/container-engine/docs/spec-schema" rel="nofollow">https://cloud.google.com/container-engine/docs/spec-schema</a>  (which I have been using heavily as I could not see any other current doc) I have not figured how to pass that through the spec file.</p>
<p dir="auto">Talking to <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/brendandburns/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/brendandburns">@brendandburns</a> on Mailing list his reply<br>
"<br>
Yes, afaik we don't support that flag currently.  We'd welcome a PR to add support.  Please file an issue on github or send code.</p>
<p dir="auto">You can use hostDir to mount the device file into your container, but I don't know if the permissions will work correctly if you don't have --privileged set.<br>
"</p>
<p dir="auto">Filing this GitHub issue as a tracker for this small enhancement.</p>
<p dir="auto">It would be nice if the <a href="https://github.com/GoogleCloudPlatform/kubernetes/blob/master/pkg/api/v1beta3/types.go#L372">container api payload</a> had support for exposing host devices to the container (like <code class="notranslate">docker run --device</code> does).</p>
<p dir="auto">The kubelet could pass it <a href="https://github.com/fsouza/go-dockerclient">go-dockerclient</a> once they add support for it (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="62793894" data-permission-text="Title is private" data-url="https://github.com/fsouza/go-dockerclient/issues/241" data-hovercard-type="issue" data-hovercard-url="/fsouza/go-dockerclient/issues/241/hovercard" href="https://github.com/fsouza/go-dockerclient/issues/241">fsouza/go-dockerclient#241</a>), or create container with the docker remote api by passing an addition member in the <code class="notranslate">/create</code> <code class="notranslate">HostConfig</code> payload:</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="{
    &quot;PathOnHost&quot;: &quot;/dev/deviceName&quot;,
    &quot;PathInContainer&quot;: &quot;/dev/deviceName&quot;,
    &quot;CgroupPermissions&quot;: &quot;mrw&quot;
}"><pre class="notranslate"><code class="notranslate">{
    "PathOnHost": "/dev/deviceName",
    "PathInContainer": "/dev/deviceName",
    "CgroupPermissions": "mrw"
}
</code></pre></div>