Add proper labels to the container image

[felichas]

Describe the bug

The container image is built using nginx-unprivileged as base image
FROM nginxinc/nginx-unprivileged:stable-alpine AS production-stage
but the base image labels are not being overwriten.

This can be confusing, because when I inspect it-tools:2026.1.4 I expect to see information about it-tools, but instead I get:

$ docker inspect sharevb/it-tools:2026.1.4 |grep -A10 Labels
            "Labels": {
                "maintainer": "NGINX Docker Maintainers <docker-maint@nginx.com>",
                "org.opencontainers.image.created": "2025-12-29T01:40:25.308Z",
                "org.opencontainers.image.description": "Unprivileged NGINX Dockerfiles",
                "org.opencontainers.image.licenses": "Apache-2.0",
                "org.opencontainers.image.revision": "74cdb36f80774b3b85badfc8ffec6d5ebdfedca8",
                "org.opencontainers.image.source": "https://github.com/nginx/docker-nginx-unprivileged",
                "org.opencontainers.image.title": "docker-nginx-unprivileged",
                "org.opencontainers.image.url": "https://github.com/nginx/docker-nginx-unprivileged",
                "org.opencontainers.image.version": "1.28.0-alpine"
            },

And it is also confusing tools like PatchPanda that use labels to work.

What happened?

When inspecting an it-tool s image, I expect to see labels relevant to it-tools.

• In the first example above, where I was inspecting sharevb/it-tools:2026.1.4, I would expect at least Label:
  "org.opencontainers.image.version": "2026.1.4"
  Probably Labels maintainer, title, source, url... too.
• In the second example above, the screenshot where PatchPanda was discovering an it-tools instalation running sharevb/it-tools:latest, I would expect the label:
  "org.opencontainers.image.version": "latest"
  Probably Labels maintainer, title, source, url... too.

System information

Debian 12 Bookworm , on aarch64, with docker compose.

$ docker version
Client: Docker Engine - Community
 Version:           29.3.1
...

Where did you encounter the bug?

A self hosted

[felichas]

Fixing this from the server side, is as simple as adding the labels you want to add/overwrite to the Dockerfile (I updated some of them, but not all)

LABEL maintainer="NGINX Docker Maintainers <docker-maint@nginx.com>" \
      org.opencontainers.image.created="2026-02-23T01:48:31.459Z" \
      org.opencontainers.image.description="Unprivileged NGINX Dockerfiles" \
      org.opencontainers.image.licenses="Apache-2.0" \
      org.opencontainers.image.revision="61141700fbe3bb03ee7379fd0a5cba5c9c5fc885" \
      org.opencontainers.image.source="https://github.com/sharevb/it-tools" \
      org.opencontainers.image.title="it-tools" \
      org.opencontainers.image.url="https://github.com/sharevb/it-tools" \
      org.opencontainers.image.version="latest"

To fix this as a user of it-tools, you can build the image yourself, adding the above LABEL command.
Or more straight forward: you could just add labels in the compose.yaml...
This compose.yaml fixed PatchPanda's confusions for me:

services:
  it-tools:
    container_name: it-tools
    image: sharevb/it-tools:latest
    labels:
      org.opencontainers.image.source: "https://github.com/sharevb/it-tools"
      org.opencontainers.image.url: "https://github.com/sharevb/it-tools"
      org.opencontainers.image.title: "it-tools"
      org.opencontainers.image.version: "latest"
    ports:
      - 8080:8080
    restart: unless-stopped