We need to pass the `z` option with the volume mount so it gets labeled
correctly and access is possible on SELinux-enabled systems. On systems
without SELinux, the flag is a no-op.

Fixes #3199