set SELinux label for volumes

`:Z` means the volume is not shared between containers. `:z` allows
other containers to share the volume, implying read/write.

Most volumes should be labeled `:Z` unless the volume must be shared
between multiple containers.
This commit is contained in:
redbeardymcgee 2025-11-08 20:55:24 -06:00
parent 016e395601
commit e75c1417a4

View file

@ -145,7 +145,7 @@ AutoUpdate=registry
Network=invidious.network
HostName=invidious
Volume=./config.yml:/invidious/config/config.yml
Volume=./config.yml:/invidious/config/config.yml:Z
```
```ini
@ -168,7 +168,7 @@ AutoUpdate=registry
Network=invidious.network
HostName=invidious-db
Volume=invidious-db:/var/lib/postgresql/data
Volume=invidious-db:/var/lib/postgresql/data:Z
Environment=POSTGRES_DB=invidious
Environment=POSTGRES_USER=kemal
@ -199,7 +199,7 @@ AutoUpdate=registry
Network=invidious.network
HostName=invidious-companion
Volume=invidious-companion-cache:/var/tmp/youtubei.js:rw
Volume=invidious-companion-cache:/var/tmp/youtubei.js:rw,Z
# WARNING: The container will fail to start without this env var
# NOTE: The podman secret is preferred, but you may set the env var directly like this