title: what does the docker daemon option --selinux-enabled do
body: <p>I guess it will label the containers it started, but from the output of <code>ps -eZ</code>, I don't see any difference.
  For example, the container <code>etcd</code> has the same domain, no matter the daemon is with and without this option:</p>
  
  <pre><code>system_u:system_r:container_runtime_t:s0 16212 ? 00:00:00 dnsmasq-nanny
  </code></pre>
  
  <p>But it does prevent my container(k8s-dns-dnsmasq-nanny-amd64:1.14.8) from starting up and the deny logs shows access to <code>/etc/localtime</code> and /usr/sbin/dnsmasq are denied. I think these are files inside container filesystem. How can I write SELinux policy to allow access inside container file system?</p>