Possible solution:
check 'chcon' is available
':z'
Background info from man docker-run:
To change a label in the container context, you can add either of two suffixes :z or :Z to the volume mount. These suffixes tell Docker to relabel file objects on the shared volumes. The z option tells Docker that two containers share the volume content. As a result, Docker labels the content with a shared content label. Shared volume labels allow all containers to read/write content. The Z option tells Docker to label the content with a private unshared label. Only the current container can use a private volume.
PR for production image: https://github.com/zanata/zanata-docker-files/pull/17#issuecomment-278184545