Podman pod and hostPath mount volume permission issue

With the kubernetes manifest below and the command podman kube play vaultwarden.pod.yaml --replace --userns=auto, I am able to run a rootless readonly container within a podman pod (with user vaultwarden).

---
apiVersion: v1
kind: Pod
metadata:
  labels:
    app: vaultwarden
  name: vaultwarden
spec:
  containers:
  - image: docker.io/vaultwarden/server:latest
    name: vaultwarden
    ports:
    - containerPort: 80
      hostPort: 8080
    securityContext:
      allowPrivilegeEscalation: false
      readOnlyRootFilesystem: true
    volumeMounts:
    - mountPath: /data
      name: vaultwarden-data
  hostUsers: false
  volumes:
  - name: vaultwarden-data
    emptyDir: {}

In order to preserve and ease the backup of data, I would like to mount the volume to a specific location. This is normaly done with the following manifest file (the difference being the volumes section and the mountPath ending with :Z).

---
apiVersion: v1
kind: Pod
metadata:
  labels:
    app: vaultwarden
  name: vaultwarden
spec:
  containers:
  - image: docker.io/vaultwarden/server:latest
    name: vaultwarden
    ports:
    - containerPort: 80
      hostPort: 8080
    securityContext:
      allowPrivilegeEscalation: false
      readOnlyRootFilesystem: true
    volumeMounts:
    - mountPath: /data:Z
      name: vaultwarden-data
  hostUsers: false
  volumes:
  - hostPath:
      path: /home/vaultwarden/data
      type: DirectoryOrCreate
    name: vaultwarden-data

but when running the commands:

• podman kube play vaultwarden.pod.yaml --replace, the container is not able to write to the folder.

[vaultwarden][ERROR] Error creating private key 'data/rsa_key.pem'
Io.
[CAUSE] Os {
    code: 2,
    kind: NotFound,
    message: "No such file or directory",
}
Exiting Vaultwarden!

• podman kube play vaultwarden.pod.yaml --replace --userns=auto, the container is not able to write to the folder.

[vaultwarden][ERROR] Error creating private key 'data/rsa_key.pem'
Io.
[CAUSE] Os {
    code: 2,
    kind: NotFound,
    message: "No such file or directory",
}
Exiting Vaultwarden!

• podman kube play vaultwarden.pod.yaml --replace --userns=keep-id, the container can crate date into the container but somehow there are still some permission denied error.

Error: Rocket.
[CAUSE] Bind(
    Os {
        code: 13,
        kind: PermissionDenied,
        message: "Permission denied",
    },
)

I used vaultwarden container as example but I have the same issue with other containers.

What is wrong with my config/command?

Many thanks