Build args and labels

Learn to customize the image with ARG and LABEL.

Build args and labels

ARG takes a value from outside at build time; LABEL adds metadata to the image:

ARG VERSION=dev
RUN go build -ldflags "-X main.version=${VERSION}" -o /out/app .

LABEL org.opencontainers.image.version=$VERSION \
      org.opencontainers.image.source="https://github.com/ornek/app"

Build: docker build --build-arg VERSION=1.4.0 -t app:1.4.0 .

Don't pass secrets with ARG

ARG values can appear in docker history output; they aren't suitable for passwords and tokens. BuildKit's secret mount is used instead:

RUN --mount=type=secret,id=netrc,target=/root/.netrc go mod download

Runtime secrets are given to the container, not the image, as environment variables or files.

Exercise Version and commit

Declare var version = "dev" and var commit = "yok", to be filled with ldflags. A function info() string returns version + " (" + commit + ")"; print the result.

Show example solution

package main

import "fmt"

var (
    version = "dev"
    commit  = "yok"
)

func info() string {
    return version + " (" + commit + ")"
}

func main() {
    fmt.Println(info())
}

Test yourself

What is the difference between ARG and ENV?
- ENV exists only at build time
- ARG stores secret values
- ARG exists only at build time, ENV also in the running container
- There is no difference
Show answer

ARG exists only at build time, ENV also in the running container — ARG values don't carry into the runtime environment; settings the program needs while running are given with ENV.

Build variable

____ VERSION=dev
RUN go build -ldflags "-X main.version=${VERSION}" .

Show answer

ARG VERSION=dev
RUN go build -ldflags "-X main.version=${VERSION}" .

Instruction and when

ARG

Build time
ENV

Run time
LABEL

Image metadata
--mount=type=secret

Secret build data

Next lesson: Summary - Docker

We Are Enhancing Your Experience

Cookie Preferences

Strictly Necessary Cookies

Analytical Cookies