Label /etc/docker/certs.d as cert_t.
getty_t should be ranged in MLS. Then also local_login_t runs as ranged domain.
Make /usr/bin/vncserver running as unconfined_service_t.