Set the images' own OCI labels instead of Ubuntu's (closes #216)

The image sets title, description, version, created, revision and
source; the last three known only at build time come from build
arguments that default to unknown, and script/docker and
script/cibuild pass them. The example app sets its own title and
description.

Model: opus-5-5

Dockerfile

@@ -124,6 +124,20 @@ RUN git checkout --quiet --detach b4b2c785308b1ce785b6155c7fe5f16879080193 \
 # ubuntu 26.04, 2026-09-27
 FROM ubuntu@sha256:f144425ff09be612d6d9ad965196e9cdc23dae1f42110a8a11a3e9a8198759f7
 
+# The image's own labels, in place of the ones it would inherit from
+# Ubuntu's. script/docker and script/cibuild pass the build arguments;
+# a build that passes none labels the image unknown rather than leave
+# Ubuntu's values.
+ARG VERSION=unknown
+ARG CREATED=unknown
+ARG REVISION=unknown
+LABEL org.opencontainers.image.title="smallwebwaf" \
+    org.opencontainers.image.description="A web application firewall for self-hosted web apps: sww rproxy in front of an app, and sww discriminator, which decides." \
+    org.opencontainers.image.version="${VERSION}" \
+    org.opencontainers.image.created="${CREATED}" \
+    org.opencontainers.image.revision="${REVISION}" \
+    org.opencontainers.image.source="https://git.eeqj.de/sneak/smallwebwaf"
+
 # runit's install creates its _runit-log user with minsysusers, which
 # reads this file in place of runit's /usr/lib/sysusers.d/runit.conf.
 # runit's line leaves out the shell, and minsysusers prints a Perl

deploy/example-app/Dockerfile

@@ -9,6 +9,10 @@
 ARG SWW_IMAGE=smallwebwaf
 FROM ${SWW_IMAGE}
 
+# Its own title and description, in place of the smallwebwaf image's.
+LABEL org.opencontainers.image.title="smallwebwaf-example-app" \
+    org.opencontainers.image.description="An example app built on the smallwebwaf image."
+
 # Packages the app needs, from the nixpkgs in the image.
 RUN nix-env -iA nixpkgs.busybox
 

script/cibuild

@@ -20,8 +20,13 @@ main() {
     # the version a build stage derives from the .git in the context.
     version="$(git describe --tags --always --dirty 2>/dev/null || true)"
     [ -n "$version" ] || version="unknown"
+    revision="$(git rev-parse HEAD 2>/dev/null || true)"
+    [ -n "$revision" ] || revision="unknown"
+    created="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
     docker build --no-cache \
         --build-arg VERSION="$version" \
+        --build-arg REVISION="$revision" \
+        --build-arg CREATED="$created" \
         -t "$("$SCRIPT_DIR/projectname")" .
 }
 

script/docker

@@ -16,8 +16,13 @@ main() {
     # the version a build stage derives from the .git in the context.
     version="$(git describe --tags --always --dirty 2>/dev/null || true)"
     [ -n "$version" ] || version="unknown"
+    revision="$(git rev-parse HEAD 2>/dev/null || true)"
+    [ -n "$revision" ] || revision="unknown"
+    created="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
     docker build --no-cache \
         --build-arg VERSION="$version" \
+        --build-arg REVISION="$revision" \
+        --build-arg CREATED="$created" \
         -t "$("$SCRIPT_DIR/projectname")" .
 }