What's alternative in pod .yaml to :z flag on directory?

[simonf-dev]

Hello, I want to bind the directory inside podman pod containers. When I try to bind it like this:

    - name: project-root
      hostPath:
        path: ../.
        type: Directory
...
      volumeMounts:
        - name: project-root
          mountPath: /project

I can't access it in the container. It doesn't work also with root privileges. When I turn off selinux on the system, then it works properly. With normal container command I can use ...:Z flag to get rid of this error, but I don't know how to handle it in the pod file.

[Luap99]

If I generate a yaml with podman generate kube I get:

---
apiVersion: v1
kind: Pod
metadata:
  annotations:
    bind-mount-options: /path/on/host:Z
...

So I assume this also works with play kube.

[rhatdan]

Yes that should work. Sadly this only works in Podman, not in Kubernetes.

[simonf-dev]

If I add these rows, I still get permission denied in the container, and the app doesn't load successfully.

[simonf-dev]

I'm thinking about these reproducible steps:

1. Create SELinux rules for the running containers by udica.
2. Edit it and allow usage of the mapped container.
3. Load these context files at every start of the pod.