From 6d788460148982b64bfefe55c97a6627b7ace2a9 Mon Sep 17 00:00:00 2001
From: sneak <sneak@sneak.berlin>
Date: Sat, 7 Nov 2026 12:39:34 +0000
Subject: [PATCH] Set the images' own OCI labels instead of Ubuntu's (closes
 #216)

The image sets title, description, version, created, revision and
source; the last three known only at build time come from build
arguments that default to unknown, and script/docker and
script/cibuild pass them. The example app sets its own title and
description.

Model: opus-5-5
---
 Dockerfile                    | 14 ++++++++++++++
 deploy/example-app/Dockerfile |  4 ++++
 script/cibuild                |  5 +++++
 script/docker                 |  5 +++++
 4 files changed, 28 insertions(+)

diff --git a/Dockerfile b/Dockerfile
index ef41ce8..f0b39f0 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -124,6 +124,20 @@ RUN git checkout --quiet --detach b4b2c785308b1ce785b6155c7fe5f16879080193 \
 # ubuntu 26.04, 2026-09-27
 FROM ubuntu@sha256:f144425ff09be612d6d9ad965196e9cdc23dae1f42110a8a11a3e9a8198759f7
 
+# The image's own labels, in place of the ones it would inherit from
+# Ubuntu's. script/docker and script/cibuild pass the build arguments;
+# a build that passes none labels the image unknown rather than leave
+# Ubuntu's values.
+ARG VERSION=unknown
+ARG CREATED=unknown
+ARG REVISION=unknown
+LABEL org.opencontainers.image.title="smallwebwaf" \
+    org.opencontainers.image.description="A web application firewall for self-hosted web apps: sww rproxy in front of an app, and sww discriminator, which decides." \
+    org.opencontainers.image.version="${VERSION}" \
+    org.opencontainers.image.created="${CREATED}" \
+    org.opencontainers.image.revision="${REVISION}" \
+    org.opencontainers.image.source="https://git.eeqj.de/sneak/smallwebwaf"
+
 # runit's install creates its _runit-log user with minsysusers, which
 # reads this file in place of runit's /usr/lib/sysusers.d/runit.conf.
 # runit's line leaves out the shell, and minsysusers prints a Perl
diff --git a/deploy/example-app/Dockerfile b/deploy/example-app/Dockerfile
index 81b6066..842e898 100644
--- a/deploy/example-app/Dockerfile
+++ b/deploy/example-app/Dockerfile
@@ -9,6 +9,10 @@
 ARG SWW_IMAGE=smallwebwaf
 FROM ${SWW_IMAGE}
 
+# Its own title and description, in place of the smallwebwaf image's.
+LABEL org.opencontainers.image.title="smallwebwaf-example-app" \
+    org.opencontainers.image.description="An example app built on the smallwebwaf image."
+
 # Packages the app needs, from the nixpkgs in the image.
 RUN nix-env -iA nixpkgs.busybox
 
diff --git a/script/cibuild b/script/cibuild
index d8d3200..76a06d4 100755
--- a/script/cibuild
+++ b/script/cibuild
@@ -20,8 +20,13 @@ main() {
     # the version a build stage derives from the .git in the context.
     version="$(git describe --tags --always --dirty 2>/dev/null || true)"
     [ -n "$version" ] || version="unknown"
+    revision="$(git rev-parse HEAD 2>/dev/null || true)"
+    [ -n "$revision" ] || revision="unknown"
+    created="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
     docker build --no-cache \
         --build-arg VERSION="$version" \
+        --build-arg REVISION="$revision" \
+        --build-arg CREATED="$created" \
         -t "$("$SCRIPT_DIR/projectname")" .
 }
 
diff --git a/script/docker b/script/docker
index 07b626c..6e9aa33 100755
--- a/script/docker
+++ b/script/docker
@@ -16,8 +16,13 @@ main() {
     # the version a build stage derives from the .git in the context.
     version="$(git describe --tags --always --dirty 2>/dev/null || true)"
     [ -n "$version" ] || version="unknown"
+    revision="$(git rev-parse HEAD 2>/dev/null || true)"
+    [ -n "$revision" ] || revision="unknown"
+    created="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
     docker build --no-cache \
         --build-arg VERSION="$version" \
+        --build-arg REVISION="$revision" \
+        --build-arg CREATED="$created" \
         -t "$("$SCRIPT_DIR/projectname")" .
 }
 
-- 
2.54.0