In this lesson, you will learn how to embed build-time context directly into your container images to ensure end-to-end traceability from source code to production deployment.
The Importance of Artifact Metadata
When a vulnerability is discovered or a production bug appears, you need to know exactly which line of code is running. Relying on image tags like latest or v1.0 is insufficient for compliance, as those tags can be overwritten or detached from the actual source state. By injecting metadata—such as the Git Commit SHA, the build timestamp, and the pipeline ID—directly into the container image, you create an immutable "birth certificate" for your artifact.
Embedding Metadata via Dockerfile
The most reliable way to attach this metadata is by using LABEL instructions during the build process. Since these labels are stored as part of the image manifest, they are available even after the container has been pushed to a registry and deployed to Kubernetes.
If you are using a standard CI/CD pipeline (like GitHub Actions or Azure DevOps), you can pass these values as build arguments:
# Define build-time variables
ARG COMMIT_SHA
ARG BUILD_ID
# Attach metadata labels
LABEL org.opencontainers.image.revision=$COMMIT_SHA
LABEL com.company.build.id=$BUILD_ID
LABEL com.company.environment="production"
In your build script, you would invoke the build like this:
docker build --build-arg COMMIT_SHA=$(git rev-parse HEAD) \
--build-arg BUILD_ID=$CI_PIPELINE_ID \
-t my-microservice:latest .
Accessing Metadata at Runtime
Once the image is deployed to your cluster, the metadata is retrievable via the container runtime. If you need your .NET application to report this metadata (for example, in a /health/info endpoint), you can retrieve the image labels using the Kubernetes API or by inspecting the container information if the labels are mirrored as environment variables.
By formalizing this process, you transform your container images from opaque blobs into audited, traceable artifacts that satisfy both security and compliance requirements.
Key Takeaway: Embedding build-time metadata via image labels creates a cryptographic link between your running workload and the exact source code revision, providing essential visibility for auditability and incident response.