From c79dad1bc1258fcfa1a0232466df8b6450f0f7b4 Mon Sep 17 00:00:00 2001
From: Charlie Savage <cfis@savagexi.com>
Date: Thu, 30 Apr 2026 20:43:55 -0700
Subject: [PATCH 1/2] fix: add ",z" SELinux relabel to CA cert bind mounts

---
 src/container/index.ts | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/src/container/index.ts b/src/container/index.ts
index 5715028..05721ba 100644
--- a/src/container/index.ts
+++ b/src/container/index.ts
@@ -152,11 +152,13 @@ export class ContainerClient {
       args.push("-e", `${key}=${value}`);
     }
 
-    // Write CA certificate to host temp file and mount into container
+    // Write CA certificate to host temp file and mount into container.
+    // `,z` is a shared SELinux relabel so the container can read the cert
+    // on enforcing systems (Fedora + podman). No-op on non-SELinux hosts.
     const hostCaPath = writeCaCertificate(config.caCertificate);
     args.push(
       "-v",
-      `${hostCaPath}:${config.caCertificateContainerPath}:ro`,
+      `${hostCaPath}:${config.caCertificateContainerPath}:ro,z`,
     );
 
     // Build combined CA bundle for system-wide trust (curl, Python, Go, etc.)
@@ -166,7 +168,7 @@ export class ContainerClient {
         args.push("-e", "SSL_CERT_FILE=/tmp/onecli-combined-ca.pem");
         // DENO_CERT: Deno does not respect SSL_CERT_FILE, it has its own env var
         args.push("-e", "DENO_CERT=/tmp/onecli-combined-ca.pem");
-        args.push("-v", `${combinedPath}:/tmp/onecli-combined-ca.pem:ro`);
+        args.push("-v", `${combinedPath}:/tmp/onecli-combined-ca.pem:ro,z`);
       }
     }
 

From 1420110a8c9bf48653b1b280e1a65988a9eb9829 Mon Sep 17 00:00:00 2001
From: Charlie Savage <cfis@savagexi.com>
Date: Sat, 18 Jul 2026 22:13:44 -0700
Subject: [PATCH 2/2] test(container): assert ,z SELinux relabel on CA cert
 mount

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 test/container/client.test.ts | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/test/container/client.test.ts b/test/container/client.test.ts
index b65f8c0..1f06eb2 100644
--- a/test/container/client.test.ts
+++ b/test/container/client.test.ts
@@ -256,9 +256,9 @@ describe("ContainerClient", () => {
       });
 
       const expectedHostPath = join(tmpdir(), "onecli-proxy-ca.pem");
-      const mountArg = args.find((a) => a.includes(":") && a.includes("onecli-proxy-ca.pem") && a.endsWith(":ro"));
+      const mountArg = args.find((a) => a.includes(":") && a.includes("onecli-proxy-ca.pem") && a.includes(":ro"));
       expect(mountArg).toBe(
-        `${expectedHostPath}:${MOCK_CONFIG.caCertificateContainerPath}:ro`,
+        `${expectedHostPath}:${MOCK_CONFIG.caCertificateContainerPath}:ro,z`,
       );
     });