Right now, it seems like our provided devices (mounts) are added before mounts defined in config.json.
This makes it so any tmpfs mounts inside config.json overwrites the mount provided by the user (if any).
Some images seem to set up a tmpfs mounts for certain volumes in case the user doesn't bind it to anything?

Maybe the tmpfs mounts provided by the oci image could be set up before the devices?