From 5460ecc6998fc86b654da2378f345c3c13a01e31 Mon Sep 17 00:00:00 2001 From: 0x5t4l1n Date: Sun, 18 Oct 2026 18:25:10 +0530 Subject: [PATCH] feat: add org.opencontainers.image.version label to release images Pass a VERSION build-arg (defaulting to 'dev') through to the final image stage and emit it as an OCI-standard version label. Update managers and container dashboards read this label to display the running release and to show a meaningful 'v_old -> v_new' diff when an update is available. Without it cloudflared surfaces only as an opaque image hash. The ARG is declared in the final stage (after the distroless FROM) so the builder stage remains unaffected. Existing CI that does not supply VERSION will get the 'dev' default; release pipelines should pass --build-arg VERSION=${{ github.ref_name }} (or equivalent). Closes #1682 --- Dockerfile | 2 ++ Dockerfile.amd64 | 2 ++ Dockerfile.arm64 | 2 ++ 3 files changed, 6 insertions(+) diff --git a/Dockerfile b/Dockerfile index 9b3496fdea6..e0244c80a2d 100644 --- a/Dockerfile +++ b/Dockerfile @@ -29,7 +29,9 @@ RUN make cloudflared # use a distroless base image with glibc FROM gcr.io/distroless/base-debian13:nonroot@sha256:0896741ba5bafd3ac87ea025a5f578952f2d238ddc3614cb368acc983a687aa2 +ARG VERSION=dev LABEL org.opencontainers.image.source="https://github.com/cloudflare/cloudflared" +LABEL org.opencontainers.image.version="${VERSION}" # copy our compiled binary COPY --from=builder --chown=nonroot /go/src/github.com/cloudflare/cloudflared/cloudflared /usr/local/bin/ diff --git a/Dockerfile.amd64 b/Dockerfile.amd64 index 4928bc54780..661677e1d99 100644 --- a/Dockerfile.amd64 +++ b/Dockerfile.amd64 @@ -22,7 +22,9 @@ RUN GOOS=linux GOARCH=amd64 make cloudflared # use a distroless base image with glibc FROM gcr.io/distroless/base-debian13:nonroot-amd64@sha256:65795e700eda57743efe12537e031042bd7832a19cc23f772acf2057dc7566f1 +ARG VERSION=dev LABEL org.opencontainers.image.source="https://github.com/cloudflare/cloudflared" +LABEL org.opencontainers.image.version="${VERSION}" # copy our compiled binary COPY --from=builder --chown=nonroot /go/src/github.com/cloudflare/cloudflared/cloudflared /usr/local/bin/ diff --git a/Dockerfile.arm64 b/Dockerfile.arm64 index 26b8d991168..c51b7ba9197 100644 --- a/Dockerfile.arm64 +++ b/Dockerfile.arm64 @@ -22,7 +22,9 @@ RUN GOOS=linux GOARCH=arm64 make cloudflared # use a distroless base image with glibc FROM gcr.io/distroless/base-debian13:nonroot-arm64@sha256:538c4d631883b52e6379c6a8e26ccaa33a1387b2153f37430b87d267f0298db0 +ARG VERSION=dev LABEL org.opencontainers.image.source="https://github.com/cloudflare/cloudflared" +LABEL org.opencontainers.image.version="${VERSION}" # copy our compiled binary COPY --from=builder --chown=nonroot /go/src/github.com/cloudflare/cloudflared/cloudflared /usr/local/bin/