Add OCI source labels to Docker images for dependency tracking #428

New Issue

MrUnknownDE · 2026-04-05T17:09:46+02:00

MrUnknownDE commented

2026-04-05 17:09:46 +02:00

Originally created by @RobertWi on 12/25/2025

Describe the Bug

Problem
Pangolin/Gerbil/Newt Docker images missing OCI source labels prevent automated dependency tracking tools (Dependabot/renovate) from linking releases/changelogs.

Even for personal use, having full control over lifecycle management is important—especially for a product with rapidly evolving release cycles and a high security posture. This would also be highly beneficial for Enterprise Edition (EE) adoption, as teams could receive automated pull or merge requests with clear guidance based on upstream changelogs.

Current Behavior

No org.opencontainers.image.source label in Dockerfiles.

Desired Behavior

Add OCI labels to all images (Pangolin, Gerbil, Newt).

Proposed Label (recommended full set (best practcve)


LABEL \
  org.opencontainers.image.source="https://github.com/fosrl/pangolin" \
  org.opencontainers.image.title="Pangolin" \
  org.opencontainers.image.description="Pangolin EE application" \
  org.opencontainers.image.licenses="your license"

Environment

OS Type & Version: (e.g., Ubuntu 24.04)
Pangolin version: ee-postgresql-1.14.1
Gerbil version: gerbil:1.3.0
Traefik version: 3.6.5
Newt version: 1.8.0

*Originally created by @RobertWi on 12/25/2025* ### Describe the Bug **Problem** Pangolin/Gerbil/Newt Docker images missing OCI source labels prevent automated dependency tracking tools (Dependabot/renovate) from linking releases/changelogs. Even for personal use, having full control over lifecycle management is important—especially for a product with rapidly evolving release cycles and a high security posture. This would also be highly beneficial for Enterprise Edition (EE) adoption, as teams could receive automated pull or merge requests with clear guidance based on upstream changelogs. **Current Behavior** - No org.opencontainers.image.source label in Dockerfiles. **Desired Behavior** - Add OCI labels to all images (Pangolin, Gerbil, Newt). Proposed Label (recommended full set (best practcve) ``` LABEL \ org.opencontainers.image.source="https://github.com/fosrl/pangolin" \ org.opencontainers.image.title="Pangolin" \ org.opencontainers.image.description="Pangolin EE application" \ org.opencontainers.image.licenses="your license" ``` ### Environment - OS Type & Version: (e.g., Ubuntu 24.04) - Pangolin version: ee-postgresql-1.14.1 - Gerbil version: gerbil:1.3.0 - Traefik version: 3.6.5 - Newt version: 1.8.0

MrUnknownDE closed this issue

2026-04-05 17:09:46 +02:00

MrUnknownDE added the stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale labels 2026-04-05 17:09:47 +02:00

Sign in to join this conversation.

Branches Tags

main

dev

dependabot/npm_and_yarn/dev-minor-updates-b4e5d6b9c5

revert-2766-feature/systemd-install-instructions

dependabot/npm_and_yarn/prod-patch-updates-05702d39f2

dependabot/npm_and_yarn/next-16.2.1

dependabot/npm_and_yarn/recharts-3.8.1

alerting-rules

private-site-ha

dependabot/docker/docker/library/node-25-slim

ssh

delete-account

msg-delivery

org-only-idp

cicd

patch

site-targets-auto-login

No Label stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/pangolin#428