Yeah, use ps -Z PID (from outside of a container) to check its label. Some other useful sources of info - the container_selinux man page tells you about contai

Yeah, use ps -Z PID (from outside of a container) to check its label. Some other useful sources of info - the container_selinux man page tells you about container_t. And an index of Dan Walsh's blog posts about containers & SELinux can be found in the README of <https://github.com/containers/container-selinux https://github.com/containers/container-selinux>. And of course the RHEL documentation for creatign custom SELinux policies that inherit from container_t (for instance, I use it to allow processes within a container to read their certificates out of /etc/pki/tls which is normally forbidden. It's documented here: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/using_selinux/creating-selinux-policies-for-containers_using-selinux#doc-wrapper https://access.redhat.com/documentation/en-us/red_hat_enterp...