Use the confine-vault label, no fstab config