Hostility in plain sight

It's a single-tree filesystem; *any* container mounting it will see the same system-wide tree. And yes, sysfs suffers the same problem (and that's one of the reasons why sysfs sucks by design), but there's it's somewhat alleviated (at the price of rather gross hacks). devtmpfs simply exposes the same directory tree, no matter which container has mounted it.

It's less of an issue than for sysfs (there we have network interfaces exposed, which hurts a lot more) and the most immediate problem has an fs of its own (devpts), but it's going to cause trouble as soon as container folks get serious about per-container block device visibility, etc.

I'd chalk that up to "lousy design likely to cause PITA for kernel work". Note that the only reason the problem exists at all is that this thing has been put kernel-side. And yes, we can kill the single-tree part of that mess, but then we'll get another source of headache with deciding how to propagate creation/removal events.

And no, that's not the only problem with that sucker.