We need to pass the `z` option with the volume mount so it gets labeled correctly and access is possible on SELinux-enabled systems. On systems without SELinux, the flag is a no-op. Fixes #3199
