While deploying two Docker containers on a CentOS Stream 9 host with SELinux in enforcing mode, you bind-mount the same host directory into each container with the option:
-v /srv/shared-data:/data:Z
The first container can create and read files under /data, but the second container receives "Permission denied" errors when it tries to access those files. Setting SELinux to permissive mode makes the error disappear, but you must keep SELinux enforcing. Which change to the volume specification will allow both containers to share the directory without disabling SELinux?
Mount the directory with the suffix ":z" instead of ":Z" ( -v /srv/shared-data:/data:z ).
Add the option --security-opt label=disable to each container.
Keep ":Z" but append the read-only flag ( -v /srv/shared-data:/data:Z,ro ).
Start both containers with the --privileged flag so SELinux no longer blocks the access.
The ":Z" suffix tells Docker (or Podman) to relabel the mount point with a private SELinux label that is unique to the first container. When a second container tries to use that path, its processes carry a different MLS/MCS label and SELinux blocks access. Replacing ":Z" with ":z" applies a shared label (container_file_t without categories), allowing any container to read and write the content while SELinux remains enforcing. Using --privileged or label=disable would also bypass the denial, but those options remove most of the confinement and are not the recommended or least-privilege fix. Adding :ro would prevent writes and still use the private label, so the problem would persist.
Ask Bash
Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.
What do the ':Z' and ':z' options mean in Docker?
Open an interactive chat with Bash
Why doesn’t adding ':Z,ro' fix the permission issue in this scenario?
Open an interactive chat with Bash
What is the impact of using '--privileged' or '--security-opt label=disable'?
Open an interactive chat with Bash
CompTIA Linux+ XK0-006 (V8)
Services and User Management
Your Score:
Report Issue
Bash, the Crucial Exams Chat Bot
AI Bot
Loading...
Loading...
Loading...
IT & Cybersecurity Package Join Premium for Full Access