Could you attach the docker command where you are seeing this behaviour? I agree the default should be shared for volume containers, and it should do nothing for bind mount volumes.

The problematic docker version:

cgal ~/tmp/docker-test $ docker version
Client version: 1.6.0
Client API version: 1.18
Go version (client): go1.4.2
Git commit (client): 8aae715/1.6.0
OS/Arch (client): linux/amd64
Server version: 1.6.0
Server API version: 1.18
Go version (server): go1.4.2
Git commit (server): 8aae715/1.6.0
OS/Arch (server): linux/amd64

Here are the commands I run:

cgal ~/tmp/docker-test $ ls -lZd volume_dir   
drwxr-xr-x. lrineau geometryfactory system_u:object_r:svirt_sandbox_file_t:s0 volume_dir

cgal ~/tmp/docker-test $ docker run -v $PWD/volume_dir:/volume:ro fedora /bin/ls /volume 
cgal ~/tmp/docker-test $ ls -lZd volume_dir
drwxr-xr-x. lrineau geometryfactory system_u:object_r:svirt_sandbox_file_t:s0:c321,c330 volume_dir

You can see that the range of volume_dir has been changed to a private label.

If I setup the volume with ":z":

cgal ~/tmp/docker-test $ docker run -v $PWD/volume_dir:/volume:z fedora /bin/ls /volume
cgal ~/tmp/docker-test $ ls -lZd volume_dir                                            
drwxr-xr-x. lrineau geometryfactory system_u:object_r:svirt_sandbox_file_t:s0 volume_dir

If I setup the volume without any mode:

cgal ~/tmp/docker-test $ docker run -v $PWD/volume_dir:/volume fedora /bin/ls /volume 
cgal ~/tmp/docker-test $ ls -lZd volume_dir                                          
drwxr-xr-x. lrineau geometryfactory system_u:object_r:svirt_sandbox_file_t:s0 volume_dir

If neither Z nor z are added to the mode, it should be shared by default. But if the mode is "ro", then the volume is relabeled to a private label. And that is the bug.

Lets check if this is fixed in docker-1.6.2.

In docker-1.6.2-10.el7.x86_64,
1.Create a dir on host:
#mkdir label
# ls -aZ
drwxr-xr-x. root root unconfined_u:object_r:admin_home_t:s0 label

# docker run -it -v label:/label-test rhel7 /bin/bash
[root@9fe47cee7961 /]# ls -aZ   
drwxr-xr-x. root root system_u:object_r:admin_home_t:s0 label-test

2.Mount with `ro`
# docker run -it -v /root/label:/label-test:ro rhel7 /bin/bash 
[root@05c2abb88a1c /]# ls -aZ
drwxr-xr-x. root root system_u:object_r:admin_home_t:s0 label-test

Move to verified

Sorry for missing steps, make up the rest.
Without `z:Z` the volume label will not change:
Give a `z`:
# docker run -it -v /root/test/sites/test.conf:/etc/nginx/conf.d/default.conf:z nginx ls -aZ /etc/nginx/conf.d/default.conf 
system_u:object_r:svirt_sandbox_file_t:s0 /etc/nginx/conf.d/default.conf
# ls -aZ test.conf 
-rw-r--r--. root root system_u:object_r:svirt_sandbox_file_t:s0 test.conf

then is `ro`, no change:
# docker run -it -v /root/test/sites/test.conf:/etc/nginx/conf.d/default.conf:ro nginx ls -aZ /etc/nginx/conf.d/default.conf 
system_u:object_r:svirt_sandbox_file_t:s0 /etc/nginx/conf.d/default.conf
# ls -aZ test.conf 
-rw-r--r--. root root system_u:object_r:svirt_sandbox_file_t:s0 test.conf

with `Z`, change again:
# docker run -it -v /root/test/sites/test.conf:/etc/nginx/conf.d/default.conf:Z nginx ls -aZ /etc/nginx/conf.d/default.conf 
system_u:object_r:svirt_sandbox_file_t:s0:c519,c558 /etc/nginx/conf.d/default.conf

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2015-1167.html

The new build is now officially on CentOS 7. Thanks a lot for the fix!