Never delved into SELinux, honestly afraid (lazy) of navigating getting into yet another rabbit hole, but from the rest of the answers here, letting podman deal with isolation sounds like a better solution. tysm for ur input :)