This appears to be the under-documented long syntax.
In case others also like to have it more explicit (it's easy to miss that :z
):
volumes:
- source: my-app-media
target: /app/media
type: volume
read_only: false
bind:
selinux: z