feat: Add support for compose devices mappings (#250)

* feat: Add support for compose `devices` mappings

https://docs.docker.com/reference/compose-file/services/#devices
```
services:
  foo:
    devices:
      - "/dev/ttyUSB0:/dev/ttyUSB0"
      - "/dev/sda:/dev/xvda:rwm"
```

* Lint fix

pkg/client/compose/service.go

@@ -140,6 +140,7 @@ func resourcesFromCompose(service types.ServiceConfig) api.ContainerResources {
 		Memory:            int64(service.MemLimit),
 		MemoryReservation: int64(service.MemReservation),
 		Ulimits:           ulimitsFromCompose(service.Ulimits),
+		DeviceMappings:    devicesFromCompose(service.Devices),
 	}
 
 	// Convert GPU device requests from compose format, appending "gpu" capability.
@@ -335,6 +336,28 @@ func ulimitsFromCompose(ulimits map[string]*types.UlimitsConfig) map[string]api.
 	return res
 }
 
+func devicesFromCompose(composeDevices []types.DeviceMapping) []container.DeviceMapping {
+	mappings := make([]container.DeviceMapping, 0, len(composeDevices))
+
+	for _, dev := range composeDevices {
+		mapping := container.DeviceMapping{
+			PathOnHost:        dev.Source,
+			PathInContainer:   dev.Target,
+			CgroupPermissions: dev.Permissions,
+		}
+
+		if mapping.PathInContainer == "" {
+			mapping.PathInContainer = mapping.PathOnHost
+		}
+		if mapping.CgroupPermissions == "" {
+			mapping.CgroupPermissions = "rwm"
+		}
+
+		mappings = append(mappings, mapping)
+	}
+	return mappings
+}
+
 // validateServicesExtensions validates extension combinations across all services in the project.
 func validateServicesExtensions(project *types.Project) error {
 	for _, service := range project.Services {

pkg/client/compose/service_test.go

@@ -1050,3 +1050,88 @@ services:
 		})
 	}
 }
+
+func TestServiceSpecFromCompose_Devices(t *testing.T) {
+	tests := []struct {
+		name             string
+		composeYAML      string
+		expectedMappings []container.DeviceMapping
+	}{
+		{
+			name: "devices_simple",
+			composeYAML: `
+services:
+  test:
+    image: nginx
+    devices:
+      - /dev/dri
+`,
+			expectedMappings: []container.DeviceMapping{
+				{
+					PathOnHost:        "/dev/dri",
+					PathInContainer:   "/dev/dri",
+					CgroupPermissions: "rwm",
+				},
+			},
+		},
+		{
+			name: "devices_full",
+			composeYAML: `
+services:
+  test:
+    image: nginx
+    devices:
+      - /dev/sda:/dev/xvda:r
+`,
+			expectedMappings: []container.DeviceMapping{
+				{
+					PathOnHost:        "/dev/sda",
+					PathInContainer:   "/dev/xvda",
+					CgroupPermissions: "r",
+				},
+			},
+		},
+		{
+			name: "multiple_devices",
+			composeYAML: `
+services:
+  test:
+    image: nginx
+    devices:
+      - "/dev/ttyUSB0:/dev/ttyUSB0:rw"
+      - /dev/sda:/dev/xvda
+      - "/dev/dri"
+`,
+			expectedMappings: []container.DeviceMapping{
+				{
+					PathOnHost:        "/dev/ttyUSB0",
+					PathInContainer:   "/dev/ttyUSB0",
+					CgroupPermissions: "rw",
+				},
+				{
+					PathOnHost:        "/dev/sda",
+					PathInContainer:   "/dev/xvda",
+					CgroupPermissions: "rwm",
+				},
+				{
+					PathOnHost:        "/dev/dri",
+					PathInContainer:   "/dev/dri",
+					CgroupPermissions: "rwm",
+				},
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			project, err := LoadProjectFromContent(context.Background(), tt.composeYAML)
+			require.NoError(t, err)
+
+			spec, err := ServiceSpecFromCompose(project, "test")
+			require.NoError(t, err)
+
+			assert.Equal(t, tt.expectedMappings, spec.Container.Resources.DeviceMappings,
+				"DeviceMappings should match expected")
+		})
+	}
+}

pkg/client/deploy/container.go

@@ -83,10 +83,13 @@ func EvalContainerSpecChange(current api.ServiceSpec, new api.ServiceSpec) Conta
 		}
 	}
 
-	// Device reservations are immutable, so we'll need to recreate if any have changed
+	// Device reservations and mappings are immutable, so we'll need to recreate if any have changed
 	if !reflect.DeepEqual(current.Container.Resources.DeviceReservations, newResources.DeviceReservations) {
 		return ContainerNeedsRecreate
 	}
+	if !reflect.DeepEqual(current.Container.Resources.DeviceMappings, newResources.DeviceMappings) {
+		return ContainerNeedsRecreate
+	}
 
 	// Check if any mutable properties changed.
 	if !current.Caddy.Equals(new.Caddy) {

pkg/client/deploy/container_test.go

@@ -1410,6 +1410,68 @@ func TestEvalContainerSpecChange_Volumes(t *testing.T) {
 	}
 }
 
+func TestEvalContainerSpecChange_DeviceMappings(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name    string
+		current api.ContainerResources
+		new     api.ContainerResources
+		want    ContainerSpecStatus
+	}{
+		{
+			name:    "empty",
+			current: api.ContainerResources{},
+			new:     api.ContainerResources{},
+			want:    ContainerUpToDate,
+		},
+		{
+			name:    "identical mapping",
+			current: api.ContainerResources{DeviceMappings: []container.DeviceMapping{{PathOnHost: "/dev/foo", PathInContainer: "/dev/foo", CgroupPermissions: "rwm"}}},
+			new:     api.ContainerResources{DeviceMappings: []container.DeviceMapping{{PathOnHost: "/dev/foo", PathInContainer: "/dev/foo", CgroupPermissions: "rwm"}}},
+			want:    ContainerUpToDate,
+		},
+		{
+			name:    "add mapping",
+			current: api.ContainerResources{},
+			new:     api.ContainerResources{DeviceMappings: []container.DeviceMapping{{PathOnHost: "/dev/foo", PathInContainer: "/dev/foo", CgroupPermissions: "rwm"}}},
+			want:    ContainerNeedsRecreate,
+		},
+		{
+			name:    "remove mapping",
+			current: api.ContainerResources{DeviceMappings: []container.DeviceMapping{{PathOnHost: "/dev/foo", PathInContainer: "/dev/foo", CgroupPermissions: "rwm"}}},
+			new:     api.ContainerResources{},
+			want:    ContainerNeedsRecreate,
+		},
+		{
+			name:    "change mapping path",
+			current: api.ContainerResources{DeviceMappings: []container.DeviceMapping{{PathOnHost: "/dev/foo", PathInContainer: "/dev/foo", CgroupPermissions: "rwm"}}},
+			new:     api.ContainerResources{DeviceMappings: []container.DeviceMapping{{PathOnHost: "/dev/foo", PathInContainer: "/dev/bar", CgroupPermissions: "rwm"}}},
+			want:    ContainerNeedsRecreate,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			currentSpec := api.ServiceSpec{
+				Container: api.ContainerSpec{
+					Image:     "nginx:latest",
+					Resources: tt.current,
+				},
+			}
+			newSpec := api.ServiceSpec{
+				Container: api.ContainerSpec{
+					Image:     "nginx:latest",
+					Resources: tt.new,
+				},
+			}
+
+			result := EvalContainerSpecChange(currentSpec, newSpec)
+			assert.Equal(t, tt.want, result)
+		})
+	}
+}
+
 func TestEvalContainerSpecChange_DeviceReservations(t *testing.T) {
 	t.Parallel()