Explanation
SELinux is not blocking this operation. SELinux is a security module that enforces mandatory access control policies on Linux systems. SELinux can restrict the actions of processes and users based on their security contexts and labels. However, SELinux does not prevent a user from setting the system time from inside a Docker container. The reason why a user's attempts to set the system time from inside a Docker container are unsuccessful is because Docker containers share the same kernel and clock as the host by default. Therefore, changing the system time inside a container requires privileged access to the host kernel, which is not allowed by default for security reasons. To allow a user to set the system time from inside a Docker container, you need to run the container with the --privileged flag or the --cap-add SYS_TIME flag. References:
https://docs.docker.com/engine/security/selinux/,
https://docs.docker.com/engine/reference/run/#runtime-privilege-and-linux-capabilities

Explanation
Optimizing images by copying artifacts selectively from previous stages is an advantage of multi-stage builds.
Multi-stage builds allow you to use multiple FROM statements in your Dockerfile, each starting a new stage of the build. You can selectively copy artifacts from one stage to another, leaving behind everything you don't want in the final image. This reduces the size and complexity of your images, and improves security and performance. References: https://docs.docker.com/build/building/multi-stage/,
https://docs.docker.com/engine/reference/builder/#copy

Explanation
Image role-based access control is not a function of UCP. UCP has its own built-in authentication mechanism and integrates with LDAP services. It also has role-based access control (RBAC), so that you can control who can access and make changes to your cluster and applications1. However, image role-based access control is a feature of Docker Trusted Registry (DTR), which integrates with UCP and allows you to manage the images you use for your applications2. DTR lets you define granular permissions for images, such as who can push, pull, delete, or scan them3. References: Universal Control Plane overview), Docker Trusted Registry overview), Docker Access Control)

Explanation
This command will display a list of volumes for a specific container, because it uses docker container inspect to show detailed information about a container, including its volumes. According to the official documentation, docker container inspect will show the Mounts section that contains information about all volumes mounted by the container.
References: https://docs.docker.com/engine/reference/commandline/container_inspect/
https://docs.docker.com/storage/volumes/#start-a-container-with-a-volume