docker: a plain docker build . stamps the git version (closes #210)

A plain `docker build .`, which is how upaas builds, stamped `dev`:
`.dockerignore` left out `.git` and the builder declared
`ARG VERSION=dev`. `.dockerignore` now sends `.git` without
`.git/config`, which can hold a credential, and lists no tracked file,
which git in the build would count as deleted and mark `-dirty`.
`ARG VERSION` has no default. The Makefile takes a non-empty `VERSION`
from the command line or the environment, so a build arg still wins
(`script/docker` keeps passing one); otherwise `git describe` runs in
the builder. A new `make version` prints the version, and the builder
fails when the context carries `.git`, directory or file, and it comes
out empty, `dev` or `unknown`.

Model: opus-5-5

Dockerfile

@@ -24,11 +24,6 @@ FROM golang@sha256:f6751d823c26342f9506c03797d2527668d095b0a15f1862cddb4d927a7a4
 
 RUN apk add --no-cache git make gcc musl-dev binutils-gold
 
-# A build context sent as a tar archive keeps its files' owners, and git
-# refuses to read a checkout owned by another user. Trust this one
-# whoever owns it.
-RUN git config --system --add safe.directory /src
-
 # Force BuildKit to run the lint stage before proceeding
 COPY --from=lint /src/go.sum /dev/null
 

README.md

@@ -592,19 +592,15 @@ appears in the startup log and in the health check response.
 
 The image takes it the same way, from the `.git` the build context carries, so a
 plain `docker build .` of a clone stamps the commit it was built from; a clone
-without tags stamps the short commit. A clone made with `--depth 1` carries at
-most a tag on its own commit, so such a clone of an untagged commit stamps the
-short commit. In a build from a directory, `.dockerignore` keeps out
-`.git/config`, which `git describe` does not need and which can hold a
-credential. Docker does not apply `.dockerignore` to a context sent as a tar
-archive, as upaas sends it, so that context carries `.git/config` into the
-build. It also keeps its files' owners, so git in the build trusts the checkout
-whoever owns it. A non-empty `--build-arg VERSION=...` takes precedence;
-`make docker` passes the version `git describe` gives on the host. The build
-fails when the context carries `.git`, as a directory or as a file, and the
-version comes out empty, `dev` or `unknown`. `.dockerignore` must list no
-tracked file: git in the build would see it as deleted and mark the version
-`-dirty`.
+without tags stamps the short commit. A shallow clone carries only a tag on its
+own commit, so a shallow clone of an untagged commit stamps the short commit.
+`.dockerignore` sends `.git` without `.git/config`, which `git describe` does
+not need and which can hold a credential. A non-empty `--build-arg VERSION=...`
+takes precedence; `make docker` passes the version `git describe` gives on the
+host. The build fails when the context carries `.git`, as a directory or as a
+file, and the version comes out empty, `dev` or `unknown`. `.dockerignore` must
+list no tracked file: git in the build would see it as deleted and mark the
+version `-dirty`.
 
 ---