Handle systempaths=unconfined security option

.gitignore

@@ -20,3 +20,4 @@ env/
 venv/
 .idea/
 *.iml
+.venv/

docker/types/containers.py

@@ -382,8 +382,17 @@ def __init__(self, version, binds=None, port_bindings=None,
                     'security_opt', security_opt, 'list'
                 )
 
-            self['SecurityOpt'] = security_opt
+            filtered = []
 
+            for opt in security_opt:
+                if opt == "systempaths=unconfined":
+                    self['MaskedPaths'] = []
+                    self['ReadonlyPaths'] = []
+                else:
+                    filtered.append(opt)
+
+            self['SecurityOpt'] = filtered
+
         if sysctls:
             if not isinstance(sysctls, dict):
                 raise host_config_type_error('sysctls', sysctls, 'dict')

tests/unit/api_test.py

@@ -324,6 +324,15 @@ def test_create_host_config_secopt(self):
         assert result['SecurityOpt'] == security_opt
         with pytest.raises(TypeError):
             self.client.create_host_config(security_opt='wrong')
+
+    def test_create_host_config_systempaths_unconfined(self):
+        result = self.client.create_host_config(
+            security_opt=["systempaths=unconfined"]
+        )
+
+        assert result['MaskedPaths'] == []
+        assert result['ReadonlyPaths'] == []
+        assert result['SecurityOpt'] == []
 
     def test_stream_helper_decoding(self):
         status_code, content = fake_api.fake_responses[f"{url_prefix}events"]()