The Podman man pages explains for volume mounts/binds:
Labeling systems like SELinux require that proper labels are placed on volume content mounted into a container. Without a label, the security system might prevent the processes running inside the container from using the content. By default, Podman does not change the labels set by the OS.
To change a label in the container context, you can add either of two suffixes :z or :Z to the volume mount. These suffixes tell Podman to relabel file objects on the shared volumes. The z option tells Podman that two containers share the volume content. As a result, Podman labels the content with a shared content label. Shared volume labels allow all containers to read/write content. The Z option tells Podman to label the content with a private unshared label.
The troubleshooting page explains the same thing with nearly the same words, however.
Now, being rather new to Podman and SELinux, wonder, what I actually should use when? I know, when I get permissions errors that they could be due to SELinux, so one of the two switches may fix that. But what are the differences between these two (lower-case z and upper-case Z) options?
The difference it says is:
:zcreates a shared content label
:Zcreates a private unshared label
This introduces many new words:
- shared and unshared (what does that mean?)
- ??? vs private (again, it’s not clear what this should say to me)
- also it says “content label” for one option, while the other one only says “label” – is there a difference between these two terms or is it the same?
So what do these words mean in this context? And the final question: When I should I use what?