openshift virt allows hotplugging block volumes into it's pods, which relies on the fact that changing the cgroup corresponding to the pid of the container suffices.

crun is test driving some changes it integrated recently;
it's configuring two cgroups, `*.scope` and sub cgroup called `container`
while before, the parent existed as sort of a no op
(wasn't configured, so, all devices were allowed, for example)
This results in the volume hotplug breaking since applying the device filter to the sub cgroup is not enough anymore

4.18.0 RC2

100%    

    1. Block volume hotplug to VM
    2.
    3.
    

    Failure

    Success

https://kubevirt.io/user-guide/storage/hotplug_volumes/