diff --git a/libcontainer/devices/device.go b/libcontainer/cgroups/devices/config/device.go
similarity index 99%
rename from libcontainer/devices/device.go
rename to libcontainer/cgroups/devices/config/device.go
index c2c2b3bb7..05ad3ef8c 100644
--- a/libcontainer/devices/device.go
+++ b/libcontainer/cgroups/devices/config/device.go
@@ -1,4 +1,4 @@
-package devices
+package config
 
 import (
 	"fmt"
diff --git a/libcontainer/cgroups/devices/config/mknod_unix.go b/libcontainer/cgroups/devices/config/mknod_unix.go
new file mode 100644
index 000000000..98cdc6e2f
--- /dev/null
+++ b/libcontainer/cgroups/devices/config/mknod_unix.go
@@ -0,0 +1,14 @@
+package config
+
+import (
+	"errors"
+
+	"golang.org/x/sys/unix"
+)
+
+func mkDev(d *Rule) (uint64, error) {
+	if d.Major == Wildcard || d.Minor == Wildcard {
+		return 0, errors.New("cannot mkdev() device with wildcards")
+	}
+	return unix.Mkdev(uint32(d.Major), uint32(d.Minor)), nil
+}
diff --git a/libcontainer/devices/device_deprecated.go b/libcontainer/devices/device_deprecated.go
new file mode 100644
index 000000000..6e960a424
--- /dev/null
+++ b/libcontainer/devices/device_deprecated.go
@@ -0,0 +1,20 @@
+package devices
+
+import "github.com/opencontainers/runc/libcontainer/cgroups/devices/config"
+
+// Deprecated: use [github.com/opencontainers/runc/libcontainer/cgroups/devices/config].
+const (
+	Wildcard       = config.Wildcard
+	WildcardDevice = config.WildcardDevice
+	BlockDevice    = config.BlockDevice
+	CharDevice     = config.CharDevice
+	FifoDevice     = config.FifoDevice
+)
+
+// Deprecated: use [github.com/opencontainers/runc/libcontainer/cgroups/devices/config].
+type (
+	Device      = config.Device
+	Permissions = config.Permissions
+	Type        = config.Type
+	Rule        = config.Rule
+)
diff --git a/libcontainer/devices/device_unix.go b/libcontainer/devices/device_unix.go
index d00775f51..c533eb1c6 100644
--- a/libcontainer/devices/device_unix.go
+++ b/libcontainer/devices/device_unix.go
@@ -19,13 +19,6 @@ var (
 	osReadDir = os.ReadDir
 )
 
-func mkDev(d *Rule) (uint64, error) {
-	if d.Major == Wildcard || d.Minor == Wildcard {
-		return 0, errors.New("cannot mkdev() device with wildcards")
-	}
-	return unix.Mkdev(uint32(d.Major), uint32(d.Minor)), nil
-}
-
 // DeviceFromPath takes the path to a device and its cgroup_permissions (which
 // cannot be easily queried) to look up the information about a linux device
 // and returns that information as a Device struct.