diff --git a/interface-definitions/container.xml.in b/interface-definitions/container.xml.in
index 65ac99e12..5c320e8c6 100644
--- a/interface-definitions/container.xml.in
+++ b/interface-definitions/container.xml.in
@@ -1,574 +1,578 @@
 <?xml version="1.0"?>
 <interfaceDefinition>
   <node name="container" owner="${vyos_conf_scripts_dir}/container.py">
     <properties>
       <help>Container applications</help>
       <priority>450</priority>
     </properties>
     <children>
       <tagNode name="name">
         <properties>
           <help>Container name</help>
           <constraint>
             <regex>[-a-zA-Z0-9]+</regex>
           </constraint>
           <constraintErrorMessage>Container name must be alphanumeric and can contain hyphens</constraintErrorMessage>
         </properties>
         <children>
           <leafNode name="allow-host-pid">
             <properties>
               <help>Allow sharing host process namespace with container</help>
               <valueless/>
             </properties>
           </leafNode>
           <leafNode name="allow-host-networks">
             <properties>
               <help>Allow sharing host networking with container</help>
               <valueless/>
             </properties>
           </leafNode>
           <leafNode name="capability">
             <properties>
               <help>Grant individual Linux capability to container instance</help>
               <completionHelp>
-                <list>net-admin net-bind-service net-raw setpcap sys-admin sys-module sys-nice sys-time</list>
+                <list>net-admin net-bind-service net-raw mknod setpcap sys-admin sys-module sys-nice sys-time</list>
               </completionHelp>
               <valueHelp>
                 <format>net-admin</format>
                 <description>Network operations (interface, firewall, routing tables)</description>
               </valueHelp>
               <valueHelp>
                 <format>net-bind-service</format>
                 <description>Bind a socket to privileged ports (port numbers less than 1024)</description>
               </valueHelp>
               <valueHelp>
                 <format>net-raw</format>
                 <description>Permission to create raw network sockets</description>
               </valueHelp>
+              <valueHelp>
+                <format>mknod</format>
+                <description>Permission to create special files</description>
+              </valueHelp>
               <valueHelp>
                 <format>setpcap</format>
                 <description>Capability sets (from bounded or inherited set)</description>
               </valueHelp>
               <valueHelp>
                 <format>sys-admin</format>
                 <description>Administation operations (quotactl, mount, sethostname, setdomainame)</description>
               </valueHelp>
               <valueHelp>
                 <format>sys-module</format>
                 <description>Load, unload and delete kernel modules</description>
               </valueHelp>
               <valueHelp>
                 <format>sys-nice</format>
                 <description>Permission to set process nice value</description>
               </valueHelp>
               <valueHelp>
                 <format>sys-time</format>
                 <description>Permission to set system clock</description>
               </valueHelp>
               <constraint>
-                <regex>(net-admin|net-bind-service|net-raw|setpcap|sys-admin|sys-module|sys-nice|sys-time)</regex>
+                <regex>(net-admin|net-bind-service|net-raw|mknod|setpcap|sys-admin|sys-module|sys-nice|sys-time)</regex>
               </constraint>
               <multi/>
             </properties>
           </leafNode>
           <node name="sysctl">
             <properties>
               <help>Configure namespaced kernel parameters of the container</help>
             </properties>
             <children>
               <tagNode name="parameter">
                 <properties>
                   <help>Sysctl key name</help>
                   <completionHelp>
                     <script>${vyos_completion_dir}/list_container_sysctl_parameters.sh</script>
                   </completionHelp>
                   <valueHelp>
                     <format>txt</format>
                     <description>Sysctl key name</description>
                   </valueHelp>
                   <constraint>
                     <validator name="sysctl"/>
                   </constraint>
                 </properties>
                 <children>
                   <leafNode name="value">
                     <properties>
                       <help>Sysctl configuration value</help>
                     </properties>
                   </leafNode>
                 </children>
               </tagNode>
             </children>
           </node>
           #include <include/generic-description.xml.i>
           <tagNode name="device">
             <properties>
               <help>Add a host device to the container</help>
             </properties>
             <children>
               <leafNode name="source">
                 <properties>
                   <help>Source device (Example: "/dev/x")</help>
                   <valueHelp>
                     <format>txt</format>
                     <description>Source device</description>
                   </valueHelp>
                 </properties>
               </leafNode>
               <leafNode name="destination">
                 <properties>
                   <help>Destination container device (Example: "/dev/x")</help>
                   <valueHelp>
                     <format>txt</format>
                     <description>Destination container device</description>
                   </valueHelp>
                 </properties>
               </leafNode>
             </children>
           </tagNode>
           #include <include/generic-disable-node.xml.i>
           <tagNode name="environment">
             <properties>
               <help>Add custom environment variables</help>
               <constraint>
                 #include <include/constraint/alpha-numeric-hyphen-underscore.xml.i>
               </constraint>
               <constraintErrorMessage>Environment variable name must be alphanumeric and can contain hyphen and underscores</constraintErrorMessage>
             </properties>
             <children>
               <leafNode name="value">
                 <properties>
                   <help>Set environment option value</help>
                   <valueHelp>
                     <format>txt</format>
                     <description>Set environment option value</description>
                   </valueHelp>
                 </properties>
               </leafNode>
             </children>
           </tagNode>
           <leafNode name="entrypoint">
             <properties>
               <help>Override the default ENTRYPOINT from the image</help>
               <constraint>
                 <regex>[ !#-%&amp;(-~]+</regex>
               </constraint>
               <constraintErrorMessage>Entrypoint must be ASCII characters, use &amp;quot; and &amp;apos for double and single quotes respectively</constraintErrorMessage>
             </properties>
           </leafNode>
           <leafNode name="host-name">
             <properties>
               <help>Container host name</help>
               <constraint>
                 #include <include/constraint/host-name.xml.i>
               </constraint>
               <constraintErrorMessage>Host-name must be alphanumeric and can contain hyphens</constraintErrorMessage>
             </properties>
           </leafNode>
           <leafNode name="image">
             <properties>
               <help>Container image to use</help>
               <completionHelp>
                 <script>sudo podman image list --format "{{.Repository}}:{{.Tag}}"</script>
               </completionHelp>
               <valueHelp>
                 <format>txt</format>
                 <description>Image name in the hub-registry</description>
               </valueHelp>
               <constraint>
                 <regex>[[:ascii:]]{1,255}</regex>
               </constraint>
             </properties>
           </leafNode>
           <leafNode name="command">
             <properties>
               <help>Override the default CMD from the image</help>
               <constraint>
                 <regex>[ !#-%&amp;(-~]+</regex>
               </constraint>
               <constraintErrorMessage>Command must be ASCII characters, use &amp;quot; and &amp;apos for double and single quotes respectively</constraintErrorMessage>
             </properties>
           </leafNode>
           <leafNode name="arguments">
             <properties>
               <help>The command's arguments for this container</help>
               <constraint>
                 <regex>[ !#-%&amp;(-~]+</regex>
               </constraint>
               <constraintErrorMessage>The command's arguments must be ASCII characters, use &amp;quot; and &amp;apos for double and single quotes respectively</constraintErrorMessage>
             </properties>
           </leafNode>
           <tagNode name="label">
             <properties>
               <help>Add label variables</help>
               <constraint>
                 <regex>[a-z0-9](?:[a-z0-9.-]*[a-z0-9])?</regex>
               </constraint>
               <constraintErrorMessage>Label variable name must be alphanumeric and can contain hyphen, dots and underscores</constraintErrorMessage>
             </properties>
             <children>
               <leafNode name="value">
                 <properties>
                   <help>Set label option value</help>
                   <valueHelp>
                     <format>txt</format>
                     <description>Set label option value</description>
                   </valueHelp>
                   <constraint>
                     <regex>[[:ascii:]]{1,255}</regex>
                   </constraint>
                 </properties>
               </leafNode>
             </children>
           </tagNode>
           <leafNode name="cpu-quota">
             <properties>
               <help>This limits the number of CPU resources the container can use</help>
               <valueHelp>
                 <format>u32:0</format>
                 <description>Unlimited</description>
               </valueHelp>
               <valueHelp>
                 <format>txt</format>
                 <description>Amount of CPU time the container can use in amount of cores (up to three decimals)</description>
               </valueHelp>
               <constraint>
                 <regex>(0|[1-9]\d*)(\.\d{1,3})?</regex>
               </constraint>
               <constraintErrorMessage>Container CPU limit must be a (decimal) number in range 0 to number of threads</constraintErrorMessage>
             </properties>
             <defaultValue>0</defaultValue>
           </leafNode>
           <leafNode name="memory">
             <properties>
               <help>Memory (RAM) available to this container</help>
               <valueHelp>
                 <format>u32:0</format>
                 <description>Unlimited</description>
               </valueHelp>
               <valueHelp>
                 <format>u32:1-16384</format>
                 <description>Container memory in megabytes (MB)</description>
               </valueHelp>
               <constraint>
                 <validator name="numeric" argument="--range 0-16384"/>
               </constraint>
               <constraintErrorMessage>Container memory must be in range 0 to 16384 MB</constraintErrorMessage>
             </properties>
             <defaultValue>512</defaultValue>
           </leafNode>
           <leafNode name="shared-memory">
             <properties>
               <help>Shared memory available to this container</help>
               <valueHelp>
                 <format>u32:0</format>
                 <description>Unlimited</description>
               </valueHelp>
               <valueHelp>
                 <format>u32:1-8192</format>
                 <description>Container memory in megabytes (MB)</description>
               </valueHelp>
               <constraint>
                 <validator name="numeric" argument="--range 0-8192"/>
               </constraint>
               <constraintErrorMessage>Container memory must be in range 0 to 8192 MB</constraintErrorMessage>
             </properties>
             <defaultValue>64</defaultValue>
           </leafNode>
           #include <include/name-server-ipv4-ipv6.xml.i>
           <tagNode name="network">
             <properties>
               <help>Attach user defined network to container</help>
               <completionHelp>
                 <path>container network</path>
               </completionHelp>
               #include <include/constraint/container-network.xml.i>
             </properties>
             <children>
               <leafNode name="address">
                 <properties>
                   <help>Assign static IP address to container</help>
                   <valueHelp>
                     <format>ipv4</format>
                     <description>IPv4 address</description>
                   </valueHelp>
                   <valueHelp>
                     <format>ipv6</format>
                     <description>IPv6 address</description>
                   </valueHelp>
                   <constraint>
                     <validator name="ip-address"/>
                   </constraint>
                   <multi/>
                 </properties>
               </leafNode>
             </children>
           </tagNode>
           <tagNode name="port">
             <properties>
               <help>Publish port to the container</help>
             </properties>
             <children>
               #include <include/listen-address.xml.i>
               <leafNode name="source">
                 <properties>
                   <help>Source host port</help>
                   <valueHelp>
                     <format>u32:1-65535</format>
                     <description>Source host port</description>
                   </valueHelp>
                   <valueHelp>
                     <format>start-end</format>
                     <description>Source host port range (e.g. 10025-10030)</description>
                   </valueHelp>
                   <constraint>
                     <validator name="port-range"/>
                   </constraint>
                 </properties>
               </leafNode>
               <leafNode name="destination">
                 <properties>
                   <help>Destination container port</help>
                   <valueHelp>
                     <format>u32:1-65535</format>
                     <description>Destination container port</description>
                   </valueHelp>
                   <valueHelp>
                     <format>start-end</format>
                     <description>Destination container port range (e.g. 10025-10030)</description>
                   </valueHelp>
                   <constraint>
                     <validator name="port-range"/>
                   </constraint>
                 </properties>
               </leafNode>
               <leafNode name="protocol">
                 <properties>
                   <help>Transport protocol used for port mapping</help>
                   <completionHelp>
                     <list>tcp udp</list>
                   </completionHelp>
                   <valueHelp>
                     <format>tcp</format>
                     <description>Use Transmission Control Protocol for given port</description>
                   </valueHelp>
                   <valueHelp>
                     <format>udp</format>
                     <description>Use User Datagram Protocol for given port</description>
                   </valueHelp>
                   <constraint>
                     <regex>(tcp|udp)</regex>
                   </constraint>
                 </properties>
                 <defaultValue>tcp</defaultValue>
               </leafNode>
             </children>
           </tagNode>
           <leafNode name="restart">
             <properties>
               <help>Restart options for container</help>
               <completionHelp>
                 <list>no on-failure always</list>
               </completionHelp>
               <valueHelp>
                 <format>no</format>
                 <description>Do not restart containers on exit</description>
               </valueHelp>
               <valueHelp>
                 <format>on-failure</format>
                 <description>Restart containers when they exit with a non-zero exit code, retrying indefinitely</description>
               </valueHelp>
               <valueHelp>
                 <format>always</format>
                 <description>Restart containers when they exit, regardless of status, retrying indefinitely</description>
               </valueHelp>
               <constraint>
                 <regex>(no|on-failure|always)</regex>
               </constraint>
             </properties>
             <defaultValue>on-failure</defaultValue>
           </leafNode>
           <leafNode name="uid">
             <properties>
               <help>User ID this container will run as</help>
               <valueHelp>
                 <format>u32:0-65535</format>
                 <description>User ID this container will run as</description>
               </valueHelp>
               <constraint>
                 <validator name="numeric" argument="--range 0-65535"/>
               </constraint>
             </properties>
           </leafNode>
           <leafNode name="gid">
             <properties>
               <help>Group ID this container will run as</help>
               <valueHelp>
                 <format>u32:0-65535</format>
                 <description>Group ID this container will run as</description>
               </valueHelp>
               <constraint>
                 <validator name="numeric" argument="--range 0-65535"/>
               </constraint>
             </properties>
           </leafNode>
           <tagNode name="tmpfs">
             <properties>
               <help>Mount a tmpfs filesystem into the container</help>
             </properties>
             <children>
               <leafNode name="destination">
                 <properties>
                   <help>Destination container directory</help>
                   <valueHelp>
                     <format>txt</format>
                     <description>Destination container directory</description>
                   </valueHelp>
                 </properties>
               </leafNode>
               <leafNode name="size">
                 <properties>
                   <help>tmpfs filesystem size in MB</help>
                   <valueHelp>
                     <format>u32:1-65536</format>
                     <description>tmpfs filesystem size in MB</description>
                   </valueHelp>
                   <constraint>
                     <validator name="numeric" argument="--range 1-65535"/>
                   </constraint>
                   <constraintErrorMessage>Container tmpfs size must be between 1 and 65535 MB</constraintErrorMessage>
                 </properties>
               </leafNode>
             </children>
           </tagNode>
           <tagNode name="volume">
             <properties>
               <help>Mount a volume into the container</help>
             </properties>
             <children>
               <leafNode name="source">
                 <properties>
                   <help>Source host directory</help>
                   <valueHelp>
                     <format>txt</format>
                     <description>Source host directory</description>
                   </valueHelp>
                 </properties>
               </leafNode>
               <leafNode name="destination">
                 <properties>
                   <help>Destination container directory</help>
                   <valueHelp>
                     <format>txt</format>
                     <description>Destination container directory</description>
                   </valueHelp>
                 </properties>
               </leafNode>
               <leafNode name="mode">
                 <properties>
                   <help>Volume access mode ro/rw</help>
                   <completionHelp>
                     <list>ro rw</list>
                   </completionHelp>
                   <valueHelp>
                     <format>ro</format>
                     <description>Volume mounted into the container as read-only</description>
                   </valueHelp>
                   <valueHelp>
                     <format>rw</format>
                     <description>Volume mounted into the container as read-write</description>
                   </valueHelp>
                   <constraint>
                     <regex>(ro|rw)</regex>
                   </constraint>
                 </properties>
                 <defaultValue>rw</defaultValue>
               </leafNode>
               <leafNode name="propagation">
                 <properties>
                   <help>Volume bind propagation</help>
                   <completionHelp>
                     <list>shared slave private rshared rslave rprivate</list>
                   </completionHelp>
                   <valueHelp>
                     <format>shared</format>
                     <description>Sub-mounts of the original mount are exposed to replica mounts</description>
                   </valueHelp>
                   <valueHelp>
                     <format>slave</format>
                     <description>Allow replica mount to see sub-mount from the original mount but not vice versa</description>
                   </valueHelp>
                   <valueHelp>
                     <format>private</format>
                     <description>Sub-mounts within a mount are not visible to replica mounts or the original mount</description>
                   </valueHelp>
                   <valueHelp>
                     <format>rshared</format>
                     <description>Allows sharing of mount points and their nested mount points between both the original and replica mounts</description>
                   </valueHelp>
                   <valueHelp>
                     <format>rslave</format>
                     <description>Allows mount point and their nested mount points between original an replica mounts</description>
                   </valueHelp>
                   <valueHelp>
                     <format>rprivate</format>
                     <description>No mount points within original or replica mounts in any direction</description>
                   </valueHelp>
                   <constraint>
                     <regex>(shared|slave|private|rshared|rslave|rprivate)</regex>
                   </constraint>
                 </properties>
                 <defaultValue>rprivate</defaultValue>
               </leafNode>
             </children>
           </tagNode>
         </children>
       </tagNode>
       <tagNode name="network">
         <properties>
           <help>Network name</help>
           #include <include/constraint/container-network.xml.i>
         </properties>
         <children>
           #include <include/generic-description.xml.i>
           #include <include/interface/mtu-68-16000.xml.i>
           <leafNode name="prefix">
             <properties>
               <help>Prefix which allocated to that network</help>
               <valueHelp>
                 <format>ipv4net</format>
                 <description>IPv4 network prefix</description>
               </valueHelp>
               <valueHelp>
                 <format>ipv6net</format>
                 <description>IPv6 network prefix</description>
               </valueHelp>
               <constraint>
                 <validator name="ipv4-prefix"/>
                 <validator name="ipv6-prefix"/>
               </constraint>
               <multi/>
             </properties>
           </leafNode>
           <leafNode name="no-name-server">
             <properties>
               <help>Disable Domain Name System (DNS) plugin for this network</help>
               <valueless/>
             </properties>
           </leafNode>
           #include <include/interface/vrf.xml.i>
         </children>
       </tagNode>
       <tagNode name="registry">
         <properties>
           <help>Registry Name</help>
         </properties>
         <defaultValue>docker.io quay.io</defaultValue>
         <children>
           #include <include/interface/authentication.xml.i>
           #include <include/generic-disable-node.xml.i>
         </children>
       </tagNode>
     </children>
   </node>
 </interfaceDefinition>