Skip to content

.tip

· one of the small things

Stamp the commit into the image with an OCI label

A tag tells you what someone meant to ship, not what is in the image. Bake the commit in at build time under the standard OCI key.

ARG GIT_SHA
LABEL org.opencontainers.image.revision="$GIT_SHA"

Build with --build-arg GIT_SHA=$(git rev-parse HEAD), then read it back with docker inspect --format '{{index .Config.Labels "org.opencontainers.image.revision"}}' app:latest. Labels cost nothing at runtime, and when staging disagrees with your laptop you diff two commits instead of guessing.

dockeroperations