.dockerignore

@@ -1,3 +1,4 @@
-.git
+# .git is sent so the build can stamp the version, without its config.
+.git/config
 .gitea
 /keyfunc

Dockerfile

@@ -16,7 +16,19 @@ COPY . .
 
 RUN make fmt-check
 RUN make test
-RUN make build
+
+# The version stamped into the binary: the VERSION build argument when one
+# is given, otherwise `git describe --tags --always` of the .git in the
+# build context. A context that carries .git and still yields no version
+# fails the build; with neither, as from a source tarball, it is "dev".
+ARG VERSION
+RUN version="${VERSION:-$(git describe --tags --always || echo dev)}"; \
+    if [ -e .git ] && { [ -z "$version" ] || [ "$version" = dev ] || \
+        [ "$version" = unknown ]; }; then \
+        echo "no version could be derived although the build context carries .git" >&2; \
+        exit 1; \
+    fi; \
+    make build VERSION="$version"
 
 # alpine:3.23, 2026-09-07
 FROM alpine@sha256:fd791d74b68913cbb027c6546007b3f0d3bc45125f797758156952bc2d6daf40