I can reproduce it. On a system installed by your instructions SELinux labeling is fully broken. When I run transactional-update setup-selinux it becomes a bit better, but it's still broken. Something is going wrong in the way /etc, /var, /srv and /home are setup. I don't know enough about the special sauce in the transactional setup to understand why and unfortunately my attempts to debug this from within initrd don't work because for some reason the break keyword isn't honored on the command line. @Fabian: You have a lot more experience than I in this environment. Is there documentation that describes how these overlay mounts are created in the initrd?