Q: Your organization is migrating production hosts to Red Hat Enterprise Linux (RHEL 9) with SELinux in `Enforcing` mode. When running containers mounting host directories (`docker run -v /data:/data`), processes running as root (`UID 0`) fail with `Permission denied` when reading or writing files. Disabling SELinux (`setenforce 0`) is forbidden by corporate security. You must explain how SELinux MCS category labels protect containers, apply the `:z` and `:Z` volume mount flags correctly, and avoid relabeling system directories.

SELinux assigns unique category pairs (e.g., `s0:c123,c456`) to each container process (`svirt_lxc_net_t`). The host directory typically has the default `system_u:object_r:default_t` label. SELinux kernel hooks block the container from accessing the files because the MCS categories do not match, regardless of Linux numeric UID permissions.

# Inspect process SELinux context inside container
docker run --rm alpine ps -eZ
# Output: system_u:system_r:container_t:s0:c12,c34 1 ...

# Inspect host directory SELinux label
ls -dZ /data
# Output: unconfined_u:object_r:default_t:s0 /data (Access Denied to container_t!)

Docker provides volume relabeling suffixes: `:z` relabels the directory with the shared container label (`container_file_t`), allowing multiple containers to read and write the volume concurrently. `:Z` relabels the directory with an exclusive private label (`container_file_t` with private MCS categories), ensuring only that specific container can access the files.

<!-- SELinux Mount Flags -->
:z (Shared Label):
  docker run -v /data:/data:z app1
  docker run -v /data:/data:z app2  (Both containers can safely share /data)

:Z (Private Exclusive Label):
  docker run -v /data:/data:Z app1  (Strictly locked to app1; other containers blocked)

Configure the bind mount with the `:z` or `:Z` modifier.

# Docker CLI with shared SELinux relabeling
docker run -d \
  --name web-app \
  -v /var/www/html:/usr/share/nginx/html:z \
  nginx:alpine

# Docker Compose
services:
  db:
    image: postgres:16
    volumes:
      - ./pgdata:/var/lib/postgresql/data:Z  # Private exclusive mount

Never use `:z` or `:Z` on host system directories like `/etc`, `/usr`, `/var`, or `/home`. Doing so recursively relabels critical host system files to `container_file_t`, breaking SSH logins, systemd daemons, and host services.

# DANGEROUS DISASTER ANTI-PATTERN:
# docker run -v /etc:/host-etc:Z alpine  <-- BREAKS HOST OS SELINUX LABELS!