> Insane take because we're talking about binding something from /dev/ to a namespace, which is much easier and faster than any VM pass-through even if your CPU has features for that pass-through.

Defining "works better" as quicker, simpler to set up, more intuitive, or similar... I'd still argue passing through a port rather than a device "works better".

E.g., I essentially gave up trying to pass a Google Coral through to a container. When connected, it shows up as one vendor+device ID, then once you push the firmware+model to it it reconnects with a different vendor+device ID.

Saying "anything plugged in (or not plugged in) to this USB port is this VM's problem" is quite easy to set up, handles disconnecting and reconnecting as you would expect, is resilient against whatever weird stuff the device does, upgrading or replacing the device, etc.