man docker-run

gistfile1.txt

Labeling systems like SELinux require that proper labels are placed  on
volume  content mounted into a container. Without a label, the security
system might prevent the processes running inside  the  container  from
using the content. By default, Docker does not change the labels set by
the OS.

To change a label in the container context, you can add either  of  two
suffixes  :z  or  :Z to the volume mount. These suffixes tell Docker to
relabel file objects on the shared volumes. The z option  tells  Docker
that  two  containers  share  the  volume  content. As a result, Docker
labels the content with a shared content label.  Shared  volume  labels
allow  all containers to read/write content.  The Z option tells Docker
to label the content with a private unshared label.  Only  the  current
container can use a private volume.