How can I connect a single USB device to my LXC container?

Question

TL;DR

• I have two software radio devices attached to my Linux server.
• I have an LXC container running on the Linux server.
• Both software radios have the same productid and vendorid.
• How do I attach only one of the software radios to the LXC container?

Why?

Because I want to!

More serious answer: I give less-trusted users access to LXC container, and not to the LXD host. I want these users to only see one of the software radios.

Debugging

Sanity check

• I am running a third-party utility which flashes the radios via USB
• I first connect/allow USB to both radios
  • command: lxc config device add my-container usrpUSB usb productid=6010 vendorid=0403
• I run the flashing utility, and it works
• I disconnect USB
  • command: lxc config device remove my-container usrpUSB
• I run the flashing utility, and it fails
• Conclusion: lxc USB connector works as expected

Finding what changed

• Idea: if I can find what files that lxc config changed on the container, maybe I can do it manually, so:
• Connect USB (see command above)
• List container files
  • find / -ls > /tmp/find_with_usb.txt
• Disconnect USB (see command above)
• List container files
  • find / -ls > /tmp/find_without_usb.txt
• Compare the two
  • There are over a hundred new files
  • None of them are /dev/ttyUSB* devices
  • The files are mostly in /var/lib/lxcfs and /sys/fs/cgroup directories
  • I am not sure what the source is for these on the LXD system
• Conclusion: manual path/character-device mapping will not work.

So?

• Is there some other way to do this?
• I don't see any options for further constraining USB devices (source)