Docker author here. I really doubt performance would be a problem. Namespaced linux processes access devices the same way every other process does: by getting a file descriptor to it and making syscalls against that. What we need to figure out is a portable way for a docker container to declare "I need access to the following devices". I would love to work with anyone interested to add that to the docker APIs for 1.0. I think long-term stable binary delivery is an important thing to do and I would like to help.

Ping me at [email protected] about this anytime.