Add a label with a distribution ID

[ondrejbudai]

bootc-image-builder will soon gain the ability of building an installer ISO for bootable container.

This comes with an interesting challenge: For Fedora, we use a Fedora installer, but for CentOS, we should probably use a CentOS one.

However, in order to find out what distribution is inside the bootable container, we would currently need to introspect the image to read /etc/os-release. This is surely possible, but it would be quite convenient to just read it from the labels. We fetch the labels much sooner in the image build process before fetching the whole container image. Generally speaking, the ability to know which distribution is inside the container based on its labels feels quite natural to me.

Would it be possible to add a label to the containers with the distribution ID? My suggestion is to just take ID from /etc/os-release and make it a label. VERSION_ID might be also nice.

cc @supakeen @mvo5

[cgwalters]

Makes sense, though let's look at prior art here:

$ skopeo inspect -n docker://registry.fedoraproject.org/fedora:39 | jq .Labels
{
  "license": "MIT",
  "name": "fedora",
  "vendor": "Fedora Project",
  "version": "39"
}
$ skopeo inspect -n docker://registry.access.redhat.com/ubi9/ubi:latest | jq .Labels
{
  "architecture": "x86_64",
  "build-date": "2023-12-07T04:10:37",
  "com.redhat.component": "ubi9-container",
  "com.redhat.license_terms": "https://www.redhat.com/en/about/red-hat-end-user-license-agreements#UBI",
  "description": "The Universal Base Image is designed and engineered to be the base layer for all of your containerized applications, middleware and utilities. This base image is freely redistributable, but Red Hat only supports Red Hat technologies through subscriptions for Red Hat products. This image is maintained by Red Hat and updated regularly.",
  "distribution-scope": "public",
  "io.buildah.version": "1.29.0",
  "io.k8s.description": "The Universal Base Image is designed and engineered to be the base layer for all of your containerized applications, middleware and utilities. This base image is freely redistributable, but Red Hat only supports Red Hat technologies through subscriptions for Red Hat products. This image is maintained by Red Hat and updated regularly.",
  "io.k8s.display-name": "Red Hat Universal Base Image 9",
  "io.openshift.expose-services": "",
  "io.openshift.tags": "base rhel9",
  "maintainer": "Red Hat, Inc.",
  "name": "ubi9",
  "release": "1476",
  "summary": "Provides the latest release of Red Hat Universal Base Image 9.",
  "url": "https://access.redhat.com/containers/#/registry.access.redhat.com/ubi9/images/9.3-1476",
  "vcs-ref": "eb726081eeafc660c182aae53074ec6631cb473e",
  "vcs-type": "git",
  "vendor": "Red Hat, Inc.",
  "version": "9.3"
}
$ skopeo inspect -n docker://quay.io/centos/centos:stream9 | jq .Labels
{
  "io.buildah.version": "1.29.1",
  "org.label-schema.build-date": "20231212",
  "org.label-schema.license": "GPLv2",
  "org.label-schema.name": "CentOS Stream 9 Base Image",
  "org.label-schema.schema-version": "1.0",
  "org.label-schema.vendor": "CentOS"
}
$                                                                                                                                                                                        

And for completeness:

skopeo inspect -n docker://ubuntu | jq .Labels
{
  "org.opencontainers.image.ref.name": "ubuntu",
  "org.opencontainers.image.version": "22.04"
}
$ skopeo inspect -n docker://opensuse/leap | jq .Labels                                                                                                                                    
{
  "org.openbuildservice.disturl": "obs://build.opensuse.org/openSUSE:Leap:15.5:Images/images/8d2ff72f5b3e4b5979c7802995bc09b7-opensuse-leap-image:docker",
  "org.opencontainers.image.created": "2023-12-12T09:33:35.440166711Z",
  "org.opencontainers.image.description": "Image containing a minimal environment for containers based on openSUSE Leap 15.5.",
  "org.opencontainers.image.source": "https://build.opensuse.org/package/show/openSUSE:Leap:15.5:Images/opensuse-leap-image?rev=8d2ff72f5b3e4b5979c7802995bc09b7",
  "org.opencontainers.image.title": "openSUSE Leap 15.5 Base Container",
  "org.opencontainers.image.url": "https://www.opensuse.org/",
  "org.opencontainers.image.vendor": "openSUSE Project",
  "org.opencontainers.image.version": "15.5.5.26",
  "org.opensuse.base.created": "2023-12-12T09:33:35.440166711Z",
  "org.opensuse.base.description": "Image containing a minimal environment for containers based on openSUSE Leap 15.5.",
  "org.opensuse.base.disturl": "obs://build.opensuse.org/openSUSE:Leap:15.5:Images/images/8d2ff72f5b3e4b5979c7802995bc09b7-opensuse-leap-image:docker",
  "org.opensuse.base.reference": "registry.opensuse.org/opensuse/leap:15.5.5.26",
  "org.opensuse.base.source": "https://build.opensuse.org/package/show/openSUSE:Leap:15.5:Images/opensuse-leap-image?rev=8d2ff72f5b3e4b5979c7802995bc09b7",
  "org.opensuse.base.title": "openSUSE Leap 15.5 Base Container",
  "org.opensuse.base.url": "https://www.opensuse.org/",
  "org.opensuse.base.vendor": "openSUSE Project",
  "org.opensuse.base.version": "15.5.5.26",
  "org.opensuse.reference": "registry.opensuse.org/opensuse/leap:15.5.5.26"
}
$

So there's not a lot of consistency here. It may make sense to raise some sort of standardization around mapping between os-release fields and labels with OCI upstream.

[cgwalters]

cc @rhatdan @vrothberg for thoughts on this

[rhatdan]

Yes this should be handled via labels.

[cgwalters]

Yes this should be handled via labels.

Right, but I guess what I'm asking is are you aware of any other prior art around OCI labels and /etc/os-release style information? Well, I filed opencontainers/image-spec#1152

[cgwalters]

This was done in #237