I'm working on a container that I want to add a static mount of -v /home/_username:/home/_username but I want to avoid using the z or Z mount options. I've been able to use audit2allow to create a policy that does what I need, but if a file is created in the home directory it's given the system_u context (since Docker is running as system) instead of the user_u context that I want it to have. Is there a way to specify which context Docker will create files with for selinux? I looked into the --security-opts="label=user:USER" but that seemed to be for a specific username instead of a security context.
Is it workable to run the container as the user?
see https://stackoverflow.com/questions/30052019/docker-creates-files-as-root-in-mounted-volume which mentions both creating a user in the image, running the container as that user, as well as an alternative solution using