fix: fix issue on applehv when mounting volume (#130)

[lstocchi]

This patch adds the :z bind option when mounting the volume to fix the issue on applehv.

[jeffmaury]

LGTM

[lstocchi]

@jeffmaury have you run it on your MAC? Bc it does not work for @feloy

[lstocchi]

Closing for the moment as this does not work. I had a dirty env apparently. If you execute the mount using the cli it update volume permissions and then it works fine with desktop.
By downloading the model again using desktop it does not work

[feloy]

I'm reopening to track the issue.

context:

• mac M3
• appleHV

As far as I can understand, mounting the file with the :z flag using the podman API is not making the necessary changes on the files to mount.

The steps to investigate:

• start the container with AI Studio (with podman API), and :z => no access to file
• start the container with CLI and :z => access to file
• start again the container with AI Studio (with podman API), and :z (and the same file) => access to file

Details on the file:
mount.md

[rhatdan]

A directory mounted with :z will cause podman and other container tools to run a chcon -t container_file_t -l s0 -R SOURCDIR. This will attempt to change the SELinux label to a label that is read/writable by all containers from an SELinux point of view. It can take a very long time, depending on the size of the volume being mounted in (Size means # or inodes). If it needs to change the label on 10,000,000 inodes it is going to take a long time. If the volume is coming from a nother system or outside of a virtual machine it can even take longer. Using apple hypervisor we have seen issues with the 'Z' or 'z" failing, when the source file is set read/only.

We have made a change in Podman to automatically mount all volumes from outside the VM to label them as container_file_t:s0 by default. This means that the containers can read/write all volumes mounted into the VM, and you o longer need to do :z or :Z. If you do a :Z or have previously done a :Z to a volume, then this volume will continue to be only useable by the container with the same SElinuc MCS Label.

containers/podman#21297

[jeffmaury]

That is not compatible with the Podman Desktop API

[lstocchi]

Closing as it should work by using the updated podman-desktop api -> #231