@@ -227,9 +227,10 @@ func populateCommand(c *Container, env []string) error {

 		userSpecifiedDevices = append(userSpecifiedDevices, devs...)

 	}

-	allowedDevices := append(configs.DefaultAllowedDevices, userSpecifiedDevices...)

-	autoCreatedDevices := append(configs.DefaultAutoCreatedDevices, userSpecifiedDevices...)

+	allowedDevices := mergeDevices(configs.DefaultAllowedDevices, userSpecifiedDevices)

+

+	autoCreatedDevices := mergeDevices(configs.DefaultAutoCreatedDevices, userSpecifiedDevices)

 	// TODO: this can be removed after lxc-conf is fully deprecated

 	lxcConfig, err := mergeLxcConfIntoOptions(c.hostConfig)

@@ -309,6 +310,25 @@ func populateCommand(c *Container, env []string) error {

 	return nil

 }

+func mergeDevices(defaultDevices, userDevices []*configs.Device) []*configs.Device {

+	if len(userDevices) == 0 {

+		return defaultDevices

+	}

+

+	paths := map[string]*configs.Device{}

+	for _, d := range userDevices {

+		paths[d.Path] = d

+	}

+

+	var devs []*configs.Device

+	for _, d := range defaultDevices {

+		if _, defined := paths[d.Path]; !defined {

+			devs = append(devs, d)

+		}

+	}

+	return append(devs, userDevices...)

+}

+

 // GetSize, return real size, virtual size

 func (container *Container) GetSize() (int64, int64) {

 	var (

@@ -3156,3 +3156,15 @@ func (s *DockerSuite) TestRunPublishPort(c *check.C) {

 		c.Fatalf("run without --publish-all should not publish port, out should be nil, but got: %s", out)

 	}

 }

+

+// Issue #10184.

+func (s *DockerSuite) TestDevicePermissions(c *check.C) {

+	const permissions = "crw-rw-rw-"

+	out, status := dockerCmd(c, "run", "--device", "/dev/fuse:/dev/fuse:mrw", "busybox:latest", "ls", "-l", "/dev/fuse")

+	if status != 0 {

+		c.Fatalf("expected status 0, got %d", status)

+	}

+	if !strings.HasPrefix(out, permissions) {

+		c.Fatalf("output should begin with %q, got %q", permissions, out)

+	}

+}