What corresponds to mount labels :Z and :U in the REST api?

[hllizi]

I have not managed yet to find out how to achieve the effect of using -v *host-file*:*container-file*:Z when creating a container and accessing podman via the REST api. Can anyone help me out?

[rhatdan]

What goes wrong?

[hllizi]

Using the CLI, I can create a container using -v and the suffix :Z to make the mounted file accessible from the container on SELinux-enabled systems. So if, as user me, I mount /home/me/test to /test like so on an SELinux-enabled machine:

podman create -v /home/me/test:/test:Z image-name

I can access /home/me/test (which belongs to me on the host system an is +rw).

But if I use

podman create --mount type=bind,source=/home/me/test,target=/test

the file is neither readable nor writable from the container. I know how to translate the latter command to an API call, but I do not know how to achieve the effect of :Z in the former. (Using target=/test:Z just results in the resulting file being called test:Z instead of test.)

[hllizi]

I just see that topic is a duplicate of #12095, sorry for missing that.

[hllizi]

To resolve this (issue #12095 never was marked as answered and the solution that @mheon provided was only linked to), this did the trick for me:

curl --unix-socket /run/user/1002/podman/podman.sock http://d/v3.1.2/libpod/containers/create -H "Content-Type: application/json" -d '{"Image": "image-name", "mounts": [{"Type": "bind", "Source": "/home/me/test", "Destination": "/test", "Options": ["Z"]}]}'

Note the "Options"-value. (I could not successfully translate it to the CLI yet, but I also didn't really try).