Type enforcement assigns security types to processes and filesystem objects, then lets SELinux rules control their interactions. Container processes typically use container_t, while container files use container_file_t. section 10.8 section 10.8.1
Podman volume mounts expose the boundary directly: a container process cannot read an ordinary user_home_t or ssh_home_t directory. Relabeling with :Z makes a volume private to one container; :z applies a shared, category-free label. section 10.8.1 section 10.8.2
Observe and change a volume label
Create foo under the home directory and mount it without relabeling: podman run -v ./foo:/foo ubi8 touch /foo/bar returns Permission denied. Running with -v ./foo:/foo:Z permits the write and changes the file label to container_file_t. Avoid relabeling sensitive directories such as .ssh. section 10.8.1
Type enforcement protects the host from container processes and has blocked documented container escapes, but it does not separate containers sharing the same type. Podman’s MCS enforcement assigns distinct categories; use :z only when sharing is intentional. section 10.8.1 section 10.8.2
Table 10.5 SELinux label type examples (view table figure)
Compare process, container-file, host-file, and privileged-process labels to identify which SELinux type governs an access decision. section 10.8.1
