container_runner does not support devices during docker.create_container()

[CSpyridakis]

Regarding the execution of functions in Trusted Execution Environments (TEEs) when the container runtime is utilized (using either Python or Rust APIs), it is also necessary to pass the SGX driver to the container for proper functionality.

For instance, if we were to run the container manually from a terminal, the following command would be required:

docker run --device=/dev/<sgxdriver> function_image

Hence, in the docker_utils.rs, the start_container() function could me modified like this (these are the actual modifications for our PoC):

...
let mut devices = vec![];    // This has been added.

// For now only SGX driver could be needed
let sgx_nuc_driver = rs_docker::container::DeviceStruct{
          CgroupPermissions: "rwm".to_string(),
          PathOnHost: "/dev/isgx".to_string(), 
          PathInContainer: "/dev/isgx".to_string(),
      };
devices.push(sgx_nuc_driver); //  More drivers could be included in this vector in the future if needed.

let id = match docker.create_container(
    name.to_string(),
    rs_docker::container::ContainerCreate {
        Image: image_name.clone(),
        Labels: None,
        ExposedPorts: None,
        HostConfig: Some(rs_docker::container::HostConfigCreate {
            NetworkMode: None,
            PublishAllPorts: Some(true),
            PortBindings: None,
            Devices: Some(devices),     // This is also an addition
        }),
    },
)
...

However, to achieve this, there are some concerns:

1. The latest version of rs-docker is v0.0.60, which does not support Devices out of the box. We have submitted a PR, but we do not know if or when it will be accepted, allowing us to use a newer version of rs-docker from crates.io (It could be possible however, until then, to use the code of a fork that contains the needed modifications).

2. From where we will take these devices?
   For our PoC only the SGX driver was used, therefore, it is hardcoded inside the function.

Other thoughts:
Perhaps,in the future, would it make sense for functions that utilize container runtime to support other device drivers (as an example other specialized hardware)?