systemd /dev/xx access changed when restart systemd

Question

When I restart systemd in docker container A, /dev/XXX's access will be changed. For example:

before:

docker exec -it xxxx bash 
chmod 755 /dev/random 

do:

docker restart xxxx

after:

docker exec -it xxxx bash

/dev/random will be changed to 0666

where position systemd modify this in systemd source code? Is this logically?

Is this relate to systemd-udevd?

Execute /usr/lib/systemd/systemd-udevd? [Yes, No, Skip] [**    ] (4 of 6) A start job is running for Create Volatile Files and Directories (3min 48s / no limit)y
[***   ] (5 of 6) A start job is running for Mark the need to relabel after reboot (3min 49s / no limit)(src/core/manager.c:1519) Got notification message for unit -.slice
(src/core/manager.c:1519) Got notification message for unit systemd-udevd.service
(src/core/service.c:2741) systemd-udevd.service: Got notification message from PID 503 (READY=1)
(src/core/service.c:2785) systemd-udevd.service: got READY=1
(src/core/service.c:878) systemd-udevd.service changed start -> running
(src/core/job.c:811) Job systemd-udevd.service/start finished, result=done
[  OK  ] Started udev Kernel Device Manager.

Answer 1

/dev is not a "real" filesystem, it is a devtmpfs, i.e. a tmpfs or ramdisk, with the sole purpose of holding the device nodes created at boot time by udev.

You can see this if you use df's -T option:

# df -T /dev
Filesystem     Type     1K-blocks  Used Available Use% Mounted on
udev           devtmpfs    498256     0    498256   0% /dev

Because it is a ramdisk, the contents do not survive a reboot. This is intentional, and not a problem - udev will create the device nodes needed by the system at boot time.

If you want /dev/random to have specific non-standard permissions after reboot, you'd need to create a rules file in /etc/udev/rules.d/ that set the permissions you want. It's hard to see why you'd want 755 for /dev/random, though.