`graph --drawio --drawio-args "-I"` fails on Podman/SELinux with `Permission denied: 'mcfab.clab.yml'`

[Dave-Mack]

Describe the bug

Using VS Code Containerlab extension over Remote SSH on Oracle Linux 9 (SELinux enforcing), selecting Graph (graph.io, interactive) fails.

Extension-triggered command:

/opt/containerlab/clab-wrapper.sh graph -r podman --drawio --drawio-args "-I" -t /home/<user>/<path>/mcfab.clab.yml

Observed error:

An error occurred while loading the config: [Errno 13] Permission denied: 'mcfab.clab.yml'
Clab-Io-Draw container exited with code 1

Environment

• VS Code Remote SSH
• Extension: vscode-containerlab
• OS: Oracle Linux 9
• SELinux: Enforcing
• Runtime: Podman

Notes / troubleshooting

• File is readable on host; issue is container access via SELinux-labeled bind mount.
• Non-interactive graph can succeed after SELinux relabel and/or simpler invocation.
• Interactive graph path used by extension (--drawio-args "-I") is where failure occurs in this setup.

Expected behavior

Graph interactive action should either:

1. Work out-of-the-box on Podman+SELinux hosts, or
2. Detect this condition and provide actionable guidance/workaround.

Suggested improvement

• Add Podman+SELinux detection and helpful error hint in extension output.
• Optionally offer fallback to non-interactive drawio graph when interactive mode fails.
• Document known workaround for SELinux-labeled hosts in extension docs.