I've a physical host with a quite recent Docker version:

[centos@dockerhost ~]$ docker -v
Docker version 1.9.0, build 76d6bc9

I've a block device on my host:

[centos@dockerhost ~]$ ll /dev/vdb
brw-rw----. 1 root disk 253, 16 Nov 25 08:53 /dev/vdb



I've formatted the host's block device

[centos@dockerhost ~]$ sudo mkfs.ext4 /dev/vdb
mke2fs 1.42.9 (28-Dec-2013)
[...]
Writing superblocks and filesystem accounting information: done

I've started an ubuntu docker container WITHOUT --privileged, but adding the capability "SYS_ADMIN" and mapping /dev/vdb to internal container device /dev/mydevice. Then I can mount /dev/mydevice from within the container:

[centos@dockerhost ~]$ docker run -ti --cap-add=SYS_ADMIN --device=/dev/vdb:/dev/mydevice ubuntu /bin/bash
root@4ee4fb67b679:/# ls -l /dev/mydevice
brw-rw----. 1 root disk 253, 16 Nov 25 09:03 /dev/mydevice
root@4ee4fb67b679:/# mount /dev/mydevice /mnt/
root@4ee4fb67b679:/# df -h
Filesystem                                                                                         Size  Used Avail Use% Mounted on
/dev/mapper/docker-253:1-9445551-4ee4fb67b679d46814f7ad9eeef2bc264970431dfba60a372ad50523f9db7a38   99G  268M   94G   1% /
[...]
/dev/mydevice                                                                                      976M  2.6M  907M   1% /mnt

root@4ee4fb67b679:/# cp -r /bin/ /mnt/
root@4ee4fb67b679:/# umount /mnt/
root@4ee4fb67b679:/# exit

When returned back to the host, I can check that the container ACTUALLY wrote:

[centos@dockerhost ~]$ sudo mount /dev/vdb /mnt/
[centos@dockerhost ~]$ ls -l /mnt/
total 20
drwxr-xr-x. 2 root root  4096 Nov 25 09:03 bin
drwx------. 2 root root 16384 Nov 25 09:02 lost+found


Without the --cap-app=SYS_ADMIN, I see the /dev/mydevice but I cannot mount it:

[centos@dockerhost ~]$ docker run -ti --device=/dev/vdb:/dev/mydevice ubuntu /bin/bash
root@2da677bd0934:/# ls -l /dev/mydevice
brw-rw----. 1 root disk 253, 16 Nov 25 09:09 /dev/mydevice
root@2da677bd0934:/# mount /dev/mydevice  /mnt/
mount: permission denied