If you stick purely to host relative bind mounts (/host/path:/container/path) instead of managed Docker volumes, understand the access controls enforced by Enterprise Linux distributions[cite: 1, 2]. On AlmaLinux 9, SELinux will actively block container read and write operations unless permissions and labels are explicitly handled[cite: 1, 2].

Handling SELinux with Host Bind Mounts

1. Add :z to Compose Mount Paths

If your docker-compose.yml mounts relative paths like ./app_data:/data, append :z so Docker automatically relabels ./app_data to container_file_t[cite: 1, 2]. Systems like Ubuntu ignore the :z flag, maintaining cross-platform compatibility without breaking non-SELinux environments[cite: 1].

1
2
3
4
5
6
services:
  web:
    image: nginx
    volumes:
      - ./app_data:/usr/share/nginx/html:z

2. Pre-Label the Host Directory

To avoid modifying Compose files with SELinux-specific flags, manually set the security context on the AlmaLinux host using chcon before launching the container:

1
2
sudo chcon -Rt container_file_t ./app_data

3. Disable Container Separation (Not Recommended)

You can bypass labeling by adding --security-opt label=disable or running containers in privileged mode. However, this disables core security layers on Red Hat-based distributions.

Platform Behavior Summary

• Ubuntu / Non-SELinux: Host path binds directly to container path out of the box.

• AlmaLinux / SELinux: Direct host binds trigger Permission Denied unless labeled via :z or pre-labeled with chcon.