Docker author here. I really doubt performance would be a problem. Namespaced linux processes access devices the same way every other process does: by getting a

Docker author here. I really doubt performance would be a problem. Namespaced linux processes access devices the same way every other process does: by getting a file descriptor to it and making syscalls against that. What we need to figure out is a portable way for a docker container to declare "I need access to the following devices". I would love to work with anyone interested to add that to the docker APIs for 1.0. I think long-term stable binary delivery is an important thing to do and I would like to help. Ping me at solomon@docker.com about this anytime.