Comment 6 for bug 1892895

(1) and (2) assumes that the snap author has control over the source code. In the MicroStack case a lot of external software is packaged in one snap, including LVM, util-linux for loop devices, open-iscsi initiator.

As such, an approach like this would require patching upstream projects and maintaining those patches in the snap over time.

Avoiding the use of the device cgroup will probably be a reasonable workaround for MicroStack in the short term on Ubuntu classic.