From bd753bfe2e786aece0a841ced0d18746b26ee845 Mon Sep 17 00:00:00 2001
From: cyqsimon <28627918+cyqsimon@users.noreply.github.com>
Date: Tue, 7 Jul 2026 20:20:40 +0800
Subject: [PATCH] docs: improve docs on relabelling options of `--mount`

Resolves #29124.

Signed-off-by: cyqsimon <28627918+cyqsimon@users.noreply.github.com>
---
 docs/source/markdown/options/mount.md | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/docs/source/markdown/options/mount.md b/docs/source/markdown/options/mount.md
index 87b41dd279..4121fca628 100644
--- a/docs/source/markdown/options/mount.md
+++ b/docs/source/markdown/options/mount.md
@@ -76,6 +76,11 @@ Options specific to type=**volume**:
 
 - *subpath*: Mount only a specific subpath within the volume, instead of the whole volume.
 
+- *relabel*: *shared*, *private*. Recursively walk the mount and set the security system (e.g. SELinux) label on each file to grant access permissions from the container context.
+  *shared* applies a label that grants permissions to all containers, while *private* applies a label that grants permissions to this specific container.
+
+- *z*, *Z*: shorthand for *relabel=shared* and *relabel=private*, respectively.
+
 - *idmap*: If specified, create an idmapped mount to the target user namespace in the container.
   The idmap option is only supported by Podman in rootful mode. The Linux kernel does not allow the use of idmapped file systems for unprivileged users.
   The idmap option supports a custom mapping that can be different from the user namespace used by the container.
@@ -98,7 +103,10 @@ Options specific to **bind** and **glob**:
 
 - *bind-nonrecursive*: do not set up a recursive bind mount. By default it is recursive.
 
-- *relabel*: *shared*, *private*.
+- *relabel*: *shared*, *private*. Recursively walk the mount and set the security system (e.g. SELinux) label on each file to grant access permissions from the container context.
+  *shared* applies a label that grants permissions to all containers, while *private* applies a label that grants permissions to this specific container.
+
+- *z*, *Z*: shorthand for *relabel=shared* and *relabel=private*, respectively.
 
 - *idmap*: If specified, create an idmapped mount to the target user namespace in the container.
   The idmap option is only supported by Podman in rootful mode. The Linux kernel does not allow the use of idmapped file systems for unprivileged users.