Set the images' own OCI labels instead of Ubuntu's (closes #216)

The image sets title, description, version, created, revision and
source; the last three known only at build time come from build
arguments that default to unknown, and script/docker and
script/cibuild pass them. The example app sets its own title and
description.

Model: opus-5-5

Dockerfile

@@ -124,6 +124,20 @@ RUN git checkout --quiet --detach b4b2c785308b1ce785b6155c7fe5f16879080193 \
 # ubuntu 26.04, 2026-09-27
 FROM ubuntu@sha256:f144425ff09be612d6d9ad965196e9cdc23dae1f42110a8a11a3e9a8198759f7
 
+# The image's own labels, in place of the ones it would inherit from
+# Ubuntu's. script/docker and script/cibuild pass the build arguments;
+# a build that passes none labels the image unknown rather than leave
+# Ubuntu's values.
+ARG VERSION=unknown
+ARG CREATED=unknown
+ARG REVISION=unknown
+LABEL org.opencontainers.image.title="smallwebwaf" \
+    org.opencontainers.image.description="A web application firewall for self-hosted web apps: sww rproxy in front of an app, and sww discriminator, which decides." \
+    org.opencontainers.image.version="${VERSION}" \
+    org.opencontainers.image.created="${CREATED}" \
+    org.opencontainers.image.revision="${REVISION}" \
+    org.opencontainers.image.source="https://git.eeqj.de/sneak/smallwebwaf"
+
 # runit's install creates its _runit-log user with minsysusers, which
 # reads this file in place of runit's /usr/lib/sysusers.d/runit.conf.
 # runit's line leaves out the shell, and minsysusers prints a Perl
@@ -136,19 +150,10 @@ RUN mkdir /etc/sysusers.d \
 # ca-certificates, nix-bin and runit, from Ubuntu's archive. apt fetches
 # them over plain HTTP and checks each one against the archive's signed
 # package lists, so no CA certificates are needed.
-#
-# nix-bin depends on xz-utils, whose install links man pages with
-# update-alternatives. The image's dpkg config drops man pages, so each
-# link warns. z-man, read after /etc/dpkg/dpkg.cfg.d/excludes, re-includes
-# the man1 pages for this install alone; the same step deletes them again,
-# so no man page or package is added.
-RUN echo 'path-include=/usr/share/man/man1/*' > /etc/dpkg/dpkg.cfg.d/z-man \
-    && apt-get update \
+RUN apt-get update \
     && DEBIAN_FRONTEND=noninteractive apt-get install --yes --no-install-recommends \
         ca-certificates nix-bin runit \
-    && rm -rf /var/lib/apt/lists/* /etc/dpkg/dpkg.cfg.d/z-man \
-    && find /usr/share/man/man1 ! -type d -delete \
-    && find /etc/alternatives -type l -xtype l -delete
+    && rm -rf /var/lib/apt/lists/*
 
 # Nix run by root expects a group of build users, which nix-bin does not
 # create; with the setting empty, root's builds run without them.

Makefile

@@ -1,12 +1,11 @@
-.PHONY: bootstrap setup test lint fmt fmt-check tidy check docker publish \
-	hooks build run example-app
+.PHONY: bootstrap setup test lint fmt fmt-check tidy check docker hooks build \
+	run example-app
 
 # Makefile targets are thin shims; the implementations live in script/
 # per the scripts-to-rule-them-all pattern (see the Entrypoints section
 # of README.md). tidy writes go.mod and go.sum as `go mod tidy` does,
 # which test checks. build and run are for working on the code by hand;
-# example-app checks the image with an app built on it; publish builds
-# the image on the Docker host and pushes it to the registry.
+# example-app checks the image with an app built on it.
 
 bootstrap:
 	@script/bootstrap
@@ -35,9 +34,6 @@ check:
 docker:
 	@script/docker
 
-publish:
-	@script/publish
-
 hooks:
 	@script/install-precommit
 

README.md

@@ -665,11 +665,6 @@ on the host.
   `make check`.
 - `script/docker`: builds the image, whose build runs the tests and the linter
   first. `make docker`.
-- `script/publish`: runs `script/docker` on the Docker host `DOCKER_HOST`
-  (`ssh://root@fsn1app1` unless set) and pushes the image to `PUBLISH_IMAGE`
-  (`git.eeqj.de/sneak/smallwebwaf` unless set) under four tags: the UTC date as
-  `YYYY-MM-DD`, the short commit hash, the branch name and `latest`. Refuses a
-  working tree with uncommitted changes. `make publish`.
 - `script/cibuild`: what CI runs: `script/bootstrap`, `script/check`, then the
   image build.
 - `script/precommit`: run by the git pre-commit hook; runs `script/check`.

deploy/example-app/Dockerfile

@@ -9,6 +9,10 @@
 ARG SWW_IMAGE=smallwebwaf
 FROM ${SWW_IMAGE}
 
+# Its own title and description, in place of the smallwebwaf image's.
+LABEL org.opencontainers.image.title="smallwebwaf-example-app" \
+    org.opencontainers.image.description="An example app built on the smallwebwaf image."
+
 # Packages the app needs, from the nixpkgs in the image.
 RUN nix-env -iA nixpkgs.busybox
 

internal/config/config.go

@@ -397,21 +397,18 @@ var (
 	errNotPathPrefix = errors.New(
 		"is not a path prefix starting with /, such as /assets/")
 	errNotTrapPath = errors.New(
-		"is not a path starting with / and without a ?, such as /wp-login.php",
-	)
+		"is not a path starting with / and without a ?, such as /wp-login.php")
 	errNotWAFMode       = errors.New("is not off, detect or block")
 	errNotParanoiaLevel = errors.New("is not a paranoia level, from 1 to 4")
 	errNotRuleID        = errors.New(
-		"is not the id of a Core Rule Set rule, a whole number such as 942100",
-	)
+		"is not the id of a Core Rule Set rule, a whole number such as 942100")
 	errSetupRuleID = errors.New(
 		"is from 900000 to 900999, the ids of the rules that set the Core Rule Set " +
 			"up and of sww's own, which cannot be switched off")
 	errNotBoolean      = errors.New("is not true or false")
 	errNotLogRemoteURL = errors.New(
 		"is not syslog+udp, syslog+tcp or syslog+tls with a host and a port, " +
-			"and nothing more, such as syslog+tls://logs.example:6514",
-	)
+			"and nothing more, such as syslog+tls://logs.example:6514")
 	errNoCertificate = errors.New("holds no PEM certificate")
 	errNotFacility   = errors.New("is not a syslog facility such as local0 or daemon")
 	errNotAppName    = errors.New(
@@ -424,21 +421,16 @@ var (
 		"is not a header name followed by : and the header's value, " +
 			"such as Authorization:Bearer <token>")
 	errControlCharacter = errors.New(
-		"holds a control character, such as the carriage return of a Windows line end",
-	)
+		"holds a control character, such as the carriage return of a Windows line end")
 	errNotAlertEvent = errors.New(
 		"is not ban, permanent_ban, waf_block, anomaly, reputation_hit, " +
 			"source_failure or file_error")
-	errNotNumberOrOff = errors.New(
-		"is not a whole number above zero, such as 60, or off",
-	)
+	errNotNumberOrOff = errors.New("is not a whole number above zero, such as 60, or off")
 	errNotUTF8        = errors.New("is not valid UTF-8")
 	errNotASN         = errors.New("is not an AS number such as AS64496")
 	errNotPercentItem = errors.New(
 		"is not a code, : and a percentage, such as AS64496:50 or cn:25")
-	errNotPercent = errors.New(
-		"is not a percentage, a whole number from 0 to 100",
-	)
+	errNotPercent  = errors.New("is not a percentage, a whole number from 0 to 100")
 	errListedTwice = errors.New("is listed twice")
 	errNotListURL  = errors.New(
 		"is not an http or https URL without a user or a fragment, " +
@@ -447,17 +439,11 @@ var (
 	errNotAnHourOrMore = errors.New("is not a duration of 1h or more, such as 24h")
 	errNotAction       = errors.New(
 		"is not deny, limit:<percent> such as limit:25, or log")
-	errNotZone = errors.New(
-		"is not a DNS zone such as dnsbl.dronebl.org",
-	)
-	errZoneTooLong = errors.New(
-		"is longer than 189 characters, too long for the " +
-			"names IPv6 clients are asked about by",
-	)
-	errNotResolver = errors.New(
-		"is not an IP address with an optional port, " +
-			"such as 192.0.2.53 or [2001:db8::53]:5353",
-	)
+	errNotZone     = errors.New("is not a DNS zone such as dnsbl.dronebl.org")
+	errZoneTooLong = errors.New("is longer than 189 characters, too long for the " +
+		"names IPv6 clients are asked about by")
+	errNotResolver = errors.New("is not an IP address with an optional port, " +
+		"such as 192.0.2.53 or [2001:db8::53]:5353")
 	errNotLAPIURL = errors.New(
 		"is not an http or https URL without a user or a fragment, " +
 			"such as http://172.17.0.1:8080")
@@ -474,9 +460,7 @@ var (
 // setting that is set but invalid is an error that names it.
 //
 //nolint:funlen // one line for each setting, a list that grows with them
-func FromEnvironment(
-	lookupEnv func(string) (string, bool),
-) (*Config, error) {
+func FromEnvironment(lookupEnv func(string) (string, bool)) (*Config, error) {
 	env := &environment{lookupEnv: lookupEnv}
 	cfg := &Config{
 		ListenAddr:           env.address("SWW_LISTEN_ADDR"),
@@ -674,10 +658,7 @@ func (e *environment) lookup(name string) (string, bool) {
 	}
 
 	if set {
-		e.check(
-			name,
-			fmt.Errorf("is set, and so is %s; %w", fileName, errSetTwice),
-		)
+		e.check(name, fmt.Errorf("is set, and so is %s; %w", fileName, errSetTwice))
 
 		return value, set
 	}
@@ -935,10 +916,7 @@ func (e *environment) zones(name string) []string {
 		logged[i] = MaskZoneKey(zone)
 	}
 
-	e.settings = append(
-		e.settings,
-		slog.String(name, strings.Join(logged, ",")),
-	)
+	e.settings = append(e.settings, slog.String(name, strings.Join(logged, ",")))
 
 	return zones
 }
@@ -1080,9 +1058,7 @@ func (e *environment) headerNames(name, defaultValue string) []string {
 
 // durationNotOff reads a setting that is a duration and, unlike a
 // timeout, cannot be off.
-func (e *environment) durationNotOff(
-	name, defaultValue string,
-) time.Duration {
+func (e *environment) durationNotOff(name, defaultValue string) time.Duration {
 	duration, err := ParseDurationNotOff(e.value(name, defaultValue))
 	e.check(name, err)
 
@@ -1281,10 +1257,7 @@ func (e *environment) instanceName() string {
 // appName reads the setting that is the APP-NAME of the records the log
 // lines are sent in, by default the instance name. Its value is checked
 // when it is set, and, while lines are sent, when it is the instance name.
-func (e *environment) appName(
-	name, instanceName string,
-	sending bool,
-) string {
+func (e *environment) appName(name, instanceName string, sending bool) string {
 	value, set := e.lookup(name)
 	if !set {
 		value = instanceName
@@ -1307,10 +1280,7 @@ func (e *environment) appName(
 // checkInstanceNameForNtfy refuses an instance name that holds a control
 // character while ntfySet, SWW_ALERT_NTFY_URL being set: ntfy is sent
 // the instance name in a header, which cannot hold one.
-func (e *environment) checkInstanceNameForNtfy(
-	instanceName string,
-	ntfySet bool,
-) {
+func (e *environment) checkInstanceNameForNtfy(instanceName string, ntfySet bool) {
 	if ntfySet && strings.ContainsFunc(instanceName, unicode.IsControl) {
 		e.check("SWW_INSTANCE_NAME", fmt.Errorf(
 			"%q %w, and is sent to ntfy in a header while SWW_ALERT_NTFY_URL is set",
@@ -1634,10 +1604,7 @@ func parseNamedNetblocks(value string) ([]anomaly.NamedNetblock, error) {
 			return nil, fmt.Errorf("%q %w", name, errListedTwice)
 		}
 
-		named = append(
-			named,
-			anomaly.NamedNetblock{Name: name, Netblock: netblock},
-		)
+		named = append(named, anomaly.NamedNetblock{Name: name, Netblock: netblock})
 	}
 
 	return named, nil
@@ -1876,11 +1843,8 @@ func parseHeaderNames(value string) ([]string, error) {
 		header := strings.ToLower(item)
 		switch header {
 		case "host":
-			return nil, fmt.Errorf(
-				"%q %w; the request's host is the field host",
-				item,
-				errHeaderTakenOut,
-			)
+			return nil, fmt.Errorf("%q %w; the request's host is the field host",
+				item, errHeaderTakenOut)
 		case "transfer-encoding":
 			return nil, fmt.Errorf("%q %w", item, errHeaderTakenOut)
 		}
@@ -1917,11 +1881,9 @@ func parseUpstreamURL(value string) (*url.URL, error) {
 	}
 
 	onlySchemeAndHost := (upstream.Scheme == "http" || upstream.Scheme == "https") &&
-		upstream.Hostname() != "" && upstream.User == nil &&
-		upstream.Opaque == "" &&
+		upstream.Hostname() != "" && upstream.User == nil && upstream.Opaque == "" &&
 		(upstream.Path == "" || upstream.Path == "/") &&
-		upstream.RawQuery == "" &&
-		upstream.Fragment == ""
+		upstream.RawQuery == "" && upstream.Fragment == ""
 	if !onlySchemeAndHost {
 		return nil, fmt.Errorf("%q %w", value, errNotUpstreamURL)
 	}
@@ -1945,11 +1907,7 @@ func parseLogRemoteURL(value string) (*url.URL, error) {
 		return nil, fmt.Errorf("%q %w", value, errNotLogRemoteURL)
 	}
 
-	schemes := []string{
-		remotelog.SchemeUDP,
-		remotelog.SchemeTCP,
-		remotelog.SchemeTLS,
-	}
+	schemes := []string{remotelog.SchemeUDP, remotelog.SchemeTCP, remotelog.SchemeTLS}
 	port, err := strconv.ParseUint(remote.Port(), 10, 16)
 
 	onlySchemeHostAndPort := slices.Contains(schemes, remote.Scheme) &&
@@ -2012,9 +1970,7 @@ func isHTTPURL(u *url.URL) bool {
 
 	return (u.Scheme == "http" || u.Scheme == "https") && u.Hostname() != "" &&
 		(u.Port() == "" || (err == nil && port != 0)) &&
-		u.User == nil &&
-		u.Opaque == "" &&
-		u.Fragment == ""
+		u.User == nil && u.Opaque == "" && u.Fragment == ""
 }
 
 // isListURL reports whether value is a URL a list can be fetched from, as
@@ -2081,12 +2037,9 @@ func parseZones(value string) ([]string, error) {
 
 	for i, zone := range zones {
 		shown := MaskZoneKey(zone)
-		listedBefore := slices.ContainsFunc(
-			zones[:i],
-			func(earlier string) bool {
+		listedBefore := slices.ContainsFunc(zones[:i], func(earlier string) bool {
 			return strings.EqualFold(MaskZoneKey(earlier), shown)
-			},
-		)
+		})
 
 		switch {
 		case len(zone) > maxZoneLength:
@@ -2173,13 +2126,8 @@ func parseWebhookHeaders(value string) (http.Header, string, error) {
 		name, headerValue, found := strings.Cut(item, ":")
 		name = strings.TrimSpace(name)
 
-		if !found || !IsHeaderName(name) ||
-			strings.ContainsAny(headerValue, "\r\n\x00") {
-			return nil, "", fmt.Errorf(
-				"item %d %w",
-				i+1,
-				errNotWebhookHeader,
-			)
+		if !found || !IsHeaderName(name) || strings.ContainsAny(headerValue, "\r\n\x00") {
+			return nil, "", fmt.Errorf("item %d %w", i+1, errNotWebhookHeader)
 		}
 
 		headers.Add(name, strings.TrimSpace(headerValue))

internal/lookup/file.go

@@ -133,11 +133,8 @@ func (f *File) Watch(ctx context.Context) {
 	}
 
 	if err != nil {
-		f.params.ProcessLog.Error(
-			"cannot watch the lookup database for replacements",
-			"error",
-			err.Error(),
-		)
+		f.params.ProcessLog.Error("cannot watch the lookup database for replacements",
+			"error", err.Error())
 
 		return
 	}
@@ -197,10 +194,7 @@ func (f *File) readAgain() {
 		f.params.Alerts.Raise(alerts.Alert{
 			Event:  alerts.EventFileError,
 			Reason: kept,
-			Detail: map[string]any{
-				"file":  f.params.Path,
-				"error": err.Error(),
-			},
+			Detail: map[string]any{"file": f.params.Path, "error": err.Error()},
 		})
 		f.params.ProcessLog.Error(kept, "error", err.Error())
 
@@ -218,11 +212,7 @@ func (f *File) use(reader *maxminddb.Reader) {
 	f.lastRead = f.params.Now()
 	f.mu.Unlock()
 
-	f.params.ProcessLog.Info(
-		"read the lookup database",
-		"file",
-		f.params.Path,
-	)
+	f.params.ProcessLog.Info("read the lookup database", "file", f.params.Path)
 }
 
 // read reads the lookup database at path. The whole file is read into

internal/requestlog/requestlog.go

@@ -19,34 +19,27 @@ const (
 	// ActionForward is a request discriminator allowed, which rproxy passes to
 	// the app.
 	ActionForward = "forward"
-
 	// ActionTooLarge is a request over the header limits.
 	ActionTooLarge = "too_large"
-
 	// ActionRateLimited is a request refused because it took its client
 	// over a rate limit, which bans the client.
 	ActionRateLimited = "rate_limited"
-
 	// ActionBanned is a request refused because a ban covers its client,
 	// or because it matched a ban rule, asked for a trap path or the
 	// CrowdSec decision list lists its client, each of which bans the
 	// client.
 	ActionBanned = "banned"
-
 	// ActionRuleBlocked is a request refused because it matched a block
 	// rule.
 	ActionRuleBlocked = "rule_blocked"
-
 	// ActionWAFBlocked is a request refused because the Core Rule Set
 	// scored it at or over SWW_WAF_ANOMALY_THRESHOLD.
 	ActionWAFBlocked = "waf_blocked"
-
 	// ActionDenied is a request refused because its client is in
 	// SWW_DENY_NETS, in a blocklist while SWW_BLOCKLIST_ACTION is deny,
 	// or listed by a DNSBL zone, or scored a hit by AbuseIPDB, while
 	// SWW_REPUTATION_ACTION is deny.
 	ActionDenied = "denied"
-
 	// ActionCountryDenied is a request refused for its client's country.
 	ActionCountryDenied = "country_denied"
 	// ActionAdmin is a request discriminator answered at one of its own
@@ -252,11 +245,7 @@ func FormatTime(t time.Time) string {
 
 // Milliseconds is d in milliseconds, to the microsecond.
 func Milliseconds(d time.Duration) float64 {
-	return float64(
-		d.Microseconds(),
-	) / float64(
-		time.Millisecond/time.Microsecond,
-	)
+	return float64(d.Microseconds()) / float64(time.Millisecond/time.Microsecond)
 }
 
 // NewProcessLogger returns the logger for the process's own messages:
@@ -264,25 +253,17 @@ func Milliseconds(d time.Duration) float64 {
 // as a request line's, and instanceName, SWW_INSTANCE_NAME, as instance.
 // It writes only the messages at level, SWW_LOG_LEVEL, or more severe;
 // the request lines Write writes are never held back.
-func NewProcessLogger(
-	w io.Writer,
-	instanceName string,
-	level slog.Level,
-) *slog.Logger {
+func NewProcessLogger(w io.Writer, instanceName string, level slog.Level) *slog.Logger {
 	handler := slog.NewJSONHandler(w, &slog.HandlerOptions{
 		Level: level,
 		ReplaceAttr: func(groups []string, attr slog.Attr) slog.Attr {
 			if attr.Key == slog.TimeKey && len(groups) == 0 {
-				return slog.String(
-					slog.TimeKey,
-					FormatTime(attr.Value.Time()),
-				)
+				return slog.String(slog.TimeKey, FormatTime(attr.Value.Time()))
 			}
 
 			return attr
 		},
 	})
 
-	return slog.New(handler).
-		With("type", "process", "instance", instanceName)
+	return slog.New(handler).With("type", "process", "instance", instanceName)
 }

script/cibuild

@@ -20,8 +20,13 @@ main() {
     # the version a build stage derives from the .git in the context.
     version="$(git describe --tags --always --dirty 2>/dev/null || true)"
     [ -n "$version" ] || version="unknown"
+    revision="$(git rev-parse HEAD 2>/dev/null || true)"
+    [ -n "$revision" ] || revision="unknown"
+    created="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
     docker build --no-cache \
         --build-arg VERSION="$version" \
+        --build-arg REVISION="$revision" \
+        --build-arg CREATED="$created" \
         -t "$("$SCRIPT_DIR/projectname")" .
 }
 

script/docker

@@ -16,8 +16,13 @@ main() {
     # the version a build stage derives from the .git in the context.
     version="$(git describe --tags --always --dirty 2>/dev/null || true)"
     [ -n "$version" ] || version="unknown"
+    revision="$(git rev-parse HEAD 2>/dev/null || true)"
+    [ -n "$revision" ] || revision="unknown"
+    created="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
     docker build --no-cache \
         --build-arg VERSION="$version" \
+        --build-arg REVISION="$revision" \
+        --build-arg CREATED="$created" \
         -t "$("$SCRIPT_DIR/projectname")" .
 }
 

script/publish

@@ -1,51 +0,0 @@
-#!/bin/sh
-# script/publish: build the image on the Docker host and push it to the
-# registry under four tags: the UTC date (YYYY-MM-DD), the short commit
-# hash, the branch name and latest. The build is script/docker's, so the
-# tests and the linter run first. The host and the registry name are
-# environment variables with defaults, for running it against another.
-#
-# The working tree must be clean: the hash tag names a commit, and an
-# image built from uncommitted changes would carry a hash that does not
-# describe it.
-set -eu
-
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
-ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
-
-: "${DOCKER_HOST:=ssh://root@fsn1app1}"
-: "${PUBLISH_IMAGE:=git.eeqj.de/sneak/smallwebwaf}"
-export DOCKER_HOST
-
-main() {
-    cd "$ROOT"
-
-    if [ -n "$(git status --porcelain)" ]; then
-        echo "script/publish: the working tree is not clean; commit or stash first" >&2
-        exit 1
-    fi
-
-    date="$(date -u +%Y-%m-%d)"
-    hash="$(git rev-parse --short HEAD)"
-    branch="$(git rev-parse --abbrev-ref HEAD)"
-    if [ "$branch" = "HEAD" ]; then
-        echo "script/publish: detached HEAD; check out a branch first" >&2
-        exit 1
-    fi
-    # A tag is [A-Za-z0-9_.-]; a branch name such as feature/x is not.
-    branch="$(printf '%s' "$branch" | tr -c 'A-Za-z0-9_.-' '-')"
-
-    local_tag="$("$SCRIPT_DIR/projectname")"
-    "$SCRIPT_DIR/docker"
-
-    for tag in "$date" "$hash" "$branch" latest; do
-        docker tag "$local_tag" "$PUBLISH_IMAGE:$tag"
-    done
-    for tag in "$date" "$hash" "$branch" latest; do
-        docker push "$PUBLISH_IMAGE:$tag"
-    done
-
-    echo "pushed $PUBLISH_IMAGE with tags: $date $hash $branch latest"
-}
-
-main "$@"