When using podman commit the container fails to boot after trying to run fixfiles

[lollipopman]

I have the following test Containerfile which boots fine:

FROM quay.io/fedora/fedora-bootc
RUN dnf install -y \
	netcat \
	sl \
	tcpdump \
	puppet \
	rubygem-rexml \
	tree \
	less \
	vim	&& dnf clean all

RUN chmod 0750 /usr/bin/puppet

CMD [ "/sbin/init" ]

However, if I run the container with podman and then use podman commit to
save the modified image, I am not able to boot it via bootc upgrade.

When I try to boot the image it complains that the filesystem needs to be re-labeled and tries to run fixfiles, which fails because the filesystem is readonly, at which point the system reboots.

Is there another step I need to make after running podman commit to fix the selinux labels?

Yours kindly, Jesse

boot output:

         Starting selinux-autorelabel.service - Relabel all filesystems...
[    4.724553] selinux-autorelabel[918]: *** Warning -- SELinux targeted policy relabel is required.
[    4.725640] selinux-autorelabel[918]: *** Relabeling could take a very long time, depending on file
[    4.726489] selinux-autorelabel[918]: *** system size and speed of hard drives.
[    4.730381] selinux-autorelabel[918]: Running: /sbin/fixfiles -T 0  restore
[   11.876119] selinux-autorelabel[934]: Warning: Skipping the following R/O filesystems:
[   11.877072] selinux-autorelabel[934]: /
[   11.877508] selinux-autorelabel[934]: /boot
[   11.877929] selinux-autorelabel[934]: /run/credentials/systemd-journald.service
[   11.878705] selinux-autorelabel[934]: /run/credentials/systemd-network-generator.service
[   11.879520] selinux-autorelabel[934]: /run/credentials/systemd-resolved.service
[   11.880271] selinux-autorelabel[934]: /run/credentials/systemd-sysctl.service
[   11.881053] selinux-autorelabel[934]: /run/credentials/systemd-tmpfiles-setup-dev-early.service
[   11.881963] selinux-autorelabel[934]: /run/credentials/systemd-tmpfiles-setup-dev.service
[   11.882806] selinux-autorelabel[934]: /run/credentials/systemd-tmpfiles-setup.service
[   11.883601] selinux-autorelabel[934]: /run/credentials/systemd-udev-load-credentials.service
[   11.884453] selinux-autorelabel[934]: /run/credentials/systemd-vconsole-setup.service
[   11.885193] selinux-autorelabel[934]: /sysroot
[   11.885669] selinux-autorelabel[934]: Relabeling /dev /dev/hugepages /dev/mqueue /dev/pts /dev/shm /etc /run /sys /sys/fs/cgroup /sys/fs/pstore /sys/kernel/debug /sys/kernel/tracing /sysroot/ostree/deploy/default/var /tmp /var
[   14.893386] selinux-autorelabel[1528]: Warning no default label for /dev/mqueue
[   14.897355] selinux-autorelabel[934]: Cleaning up labels on /tmp
[   14.919607] selinux-autorelabel[1563]: rm: cannot remove '/.autorelabel': Read-only file system