Bottom line here is that these rules look cryptic because they map to device _numbers and types_ as enumerated by the kernel. Some like `/dev/sda` translating to `b 8:0` are probably going to be consistent between different Linuxes. The rest? I have no idea.
The rule syntax is what the kernel itself uses, so that isn't Docker's fault. Still, I would love to be able to say `/dev/sda rwm` instead of `b 8:0 rwm`, by letting the Docker daemon automate the path-to-cgroup-rule translation. It would be far more docker-compose friendly. Even better, like for the sake of this article, would be to have known semantic names like 'gpu', '3daccelerator', and 'primarystorage'. Anything to make docker-compose files more useful to other people.
https://www.kernel.org/doc/html/latest/admin-guide/cgroup-v1...