GETTING STARTED INFO : You may know [ but better not to, you will sleep better ] that PVE have `device mount` support in `LXC`
which was made not by classic `lxc.mount.entry = /from /to none bind,create=dir 0 0` + all known `lxc.cgroup2.devices.allow`
but rather , yes , by all known...