From bf1f60ae7cea309c79d16e524cd6d04921efe0c8 Mon Sep 17 00:00:00 2001 From: Vedant Madane Date: Tue, 18 Aug 2026 22:01:22 +0530 Subject: [PATCH] docs: document volume :z and :Z SELinux options These options are implemented in mountutil; stop listing them as unimplemented and describe the selinux-enabled requirement. Fixes #3867 Signed-off-by: Vedant Madane --- docs/command-reference.md | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/docs/command-reference.md b/docs/command-reference.md index 20239a0f3b0..b97eb45b50f 100644 --- a/docs/command-reference.md +++ b/docs/command-reference.md @@ -292,7 +292,10 @@ Volume flags: - :whale: option `rshared`, `rslave`, `rprivate`: Recursive "shared" / "slave" / "private" propagation - :nerd_face: option `bind`: Not-recursively bind-mounted - :nerd_face: option `rbind`: Recursively bind-mounted - - unimplemented options: `:z` and `:Z` (SELinux relabeling) + - :whale: option `z`: SELinux shared (multi-category) relabel of the volume content so it can be shared among containers + - :whale: option `Z`: SELinux private unshared relabel of the volume content for this container only + - Requires SELinux on the host and nerdctl started with `--selinux-enabled` (or `selinux_enabled = true` in `nerdctl.toml`). + - Example: `nerdctl run --rm -v /var/data:/data:Z --selinux-enabled IMAGE` - :whale: `--tmpfs`: Mount a tmpfs directory, e.g. `--tmpfs /tmp:size=64m,exec`. - :whale: `--mount`: Attach a filesystem mount to the container. Consists of multiple key-value pairs, separated by commas and each