lib/modules is only needed if the container needs to load kernel
drivers. We'll make sure that any driver needed is already loaded on the
host.
dev/bus/usb was probably an attempt to get udev working in the
container. This is a bad idea.
# device access
Bind=/dev/tty0
Bind=/dev/tty1
-BindReadOnly=/dev/bus/usb
BindReadOnly=/dev/dri
BindReadOnly=/dev/input
BindReadOnly=/dev/uinput
BindReadOnly=/run/udev
BindReadOnly=/dev/lirc0
BindReadOnly=/dev/vga_arbiter
-BindReadOnly=/lib/modules
# pulse need to be started in system mode with the following module and option:
# load-module module-native-protocol auth-authorize-anonymous
BindReadOnly=/run/pulse