With the getenfore command from kumi below I get Enforcing so I guess I use SELinux.

I now have two working options. a) Using named volumes (I’m still unsure if this is the way to go or not, generally speaking) and b) using the private label :Z for the bind mount.

Without :Z podman unshare yields root:root for the data directory. After setting the label it is a different user alltogether.