# Container Image Labels > Complete reference for all container image labels --- LLMS index: [llms.txt](/llms.txt) | Full content: [llms-full.txt](/llms-full.txt) --- Hummingbird container images carry labels from multiple standards and namespaces. This page is the single reference for every label. Standards: **C** = [Conforma][conforma-labels] ([rule dataset][rule-data]), **O** = [OCI Image Spec][oci-spec], **H** = Hummingbird project, **S** = [Security schema][security-schema] ## Labels | Label | Aliases | Value | C | O | H | S | |----------------------------------------------|----------------------------------|--------------------------------------------|---|---|---|---| | `architecture` | | Host architecture (e.g., `x86_64`) | | | | ✓ | | `com.redhat.component` | | `hummingbird` | ✓ | | | | | `com.redhat.license_terms` | | [UBI EULA][ubi-eula] ¹ | | | | | | `cpe` | | CPE identifier (Hummingbird only) ² | ✓ | | | ✓ | | `distribution-scope` | | `public` | ✓ | | | | | `io.hummingbird-project.containerfile` | | Containerfile path relative to repo root ⁹ | | | ✓ | | | `io.hummingbird-project.deprecated` | | `true` for deprecated image streams | | | ✓ | | | `io.hummingbird-project.major-minor-version` | | Major.minor from tags (e.g., `2.10`) ³ | | | ✓ | | | `io.hummingbird-project.major-version` | | Major from tags (e.g., `2`) ³ | | | ✓ | | | `io.hummingbird-project.repository` | | Publishing name (e.g., `caddy`) ⁴ | | | ✓ | | | `io.hummingbird-project.stream` | | Version stream (e.g., `2`) ⁴ | | | ✓ | | | `io.hummingbird-project.variant` | | Variant name (e.g., `fpm-builder`) ⁸ | | | ✓ | | | `io.hummingbird-project.variant.base` | | Base specialization (e.g., `fpm`) ⁸ | | | ✓ | | | `io.hummingbird-project.variant.builder` | | `true` when builder (absent otherwise) ⁸ | | | ✓ | | | `io.hummingbird-project.variant.description` | | Base variant description (no modifiers) ⁸ | | | ✓ | | | `io.hummingbird-project.variant.fips` | | `true` when FIPS (absent otherwise) ⁸ | | | ✓ | | | `io.k8s.description` | | Long description ⁵ | ✓ | | | | | `maintainer` | | `Project Hummingbird / Red Hat` | ✓ | | | | | `name` | | Canonical publishing repository ² | ✓ | | | ✓ | | `org.opencontainers.image.created` | `build-date` | RFC3339 build timestamp | ✓ | ✓ | | ✓ | | `org.opencontainers.image.description` | `description` | Long description ⁵ | ✓ | ✓ | | | | `org.opencontainers.image.revision` | `vcs-ref` | Full git commit SHA | ✓ | ✓ | | | | `org.opencontainers.image.source` | | GitLab repository URL | | ✓ | | | | `org.opencontainers.image.title` | | Image name (e.g., `caddy`) | | ✓ | | | | `org.opencontainers.image.url` | `url` | Upstream project URL ⁵ | ✓ | ✓ | | | | `org.opencontainers.image.vendor` | `vendor` | `Red Hat, Inc.` ⁶ | ✓ | ✓ | | | | `org.opencontainers.image.version` | `version` | Full version from tags (e.g., `2.10.2`) ³ | ✓ | ✓ | | | | `release` | | `SOURCE_DATE_EPOCH` (commit timestamp) ⁷ | ✓ | | | | | `summary` | | Short one-liner ⁵ | ✓ | | | | | `vcs-type` | | `git` | ✓ | | | | ## Notes ### ¹ Licenses The `com.redhat.license_terms` label is not required by Conforma, OCI, or the security schema. It is a Red Hat convention present on all Red Hat container images (UBI, language runtimes, etc.), pointing to the UBI EULA. The `org.opencontainers.image.licenses` label is intentionally not set. Per-package license data is derived from [SBOMs](security-labels-and-metadata.md#software-bill-of-materials-sbom) stored as OCI artifacts alongside each image. A manually-set SPDX expression would be incomplete compared to the SBOM-derived data available in the image catalog. ### ² Name and identity The `name` label identifies the canonical publishing repository. It uses the `repository` value from `properties.yml`, prefixed by the registry organization: - Red Hat supported Hummingbird images: `hi/` - Community images: `hummingbird-community/` - Experimental images: `hummingbird-ci/` - Rawhide images: `hummingbird-rawhide/` All variants published to the same repository have the same `name` label. For example, the default and builder variants of Caddy both use `hi/caddy`. The `cpe` label is only set for Hummingbird distro images (not Rawhide). See [Security Labels and Metadata](security-labels-and-metadata.md) for details on the scanning workflow and `labels.json`. ### ³ Version labels Three version granularities are derived from the image's tags: `version` (full, e.g., `2.10.2`), `major-minor-version` (e.g., `2.10`), and `major-version` (e.g., `2`). The full version is the OCI/Conforma `org.opencontainers.image.version`; the two coarser granularities are Hummingbird project labels used for tag aliasing. There is no `io.hummingbird-project.version` label — it would duplicate the OCI label. ### ⁴ Repository and stream The `io.hummingbird-project.repository` and `io.hummingbird-project.stream` fields together form the release identity pair. Both are defined in `properties.yml`. See [image-configuration-reference.md](../contributing/image-configuration-reference.md) for field definitions. The `io.hummingbird-project.deprecated` label is present with the value `true` on the final release of a deprecated stream. It is omitted for non-deprecated streams. The catalog uses the label to preserve the current deprecation state without changing older image digests. ### ⁵ Description, summary, and URL The `description`, `summary`, and `url` fields are defined in `properties.yml`. Description and summary target different display contexts: - **summary**: One-liner (~40-80 chars) for table/list views - **description**: Short paragraph (~100-250 chars, 1-2 sentences) for card views and `podman inspect` Style rules: - Do not start `summary` or `description` with the image name - Use `>-` YAML scalar for multi-line readability in `properties.yml` - Avoid embedded double quotes and backslashes (no escaping in templates) ### ⁶ Vendor All images use `Red Hat, Inc.` as vendor (the distributing entity). The OCI `org.opencontainers.image.vendor` uses `Red Hat` (without ", Inc.") per OCI convention. Both values are set on all distros. ### ⁷ Release The `release` label uses the commit timestamp as a Unix epoch (matching Red Hat convention). In Konflux this is set via the `generate-labels` pipeline task. ### ⁸ Variant labels Each variant name is decomposed into a **base specialization** and **cross-cutting modifiers** (builder, fips). The naming convention is `[-fips][-builder]`, where modifier order does not matter. A bare modifier like `builder` has base `default`. Examples: `fpm-builder` → base=`fpm`, builder=yes; `fips-builder` → base=`default`, builder=yes, fips=yes. The `.description` label stores only the base description (e.g., "PHP FastCGI process manager"). Modifier display is handled by consumers using the `.builder` and `.fips` boolean labels. Base descriptions come from `variant_descriptions` in `images/variables.yml` (for `default`) and image-specific `properties.yml` (for bases like `fpm`, `runtime`). ### ⁹ Containerfile path The `io.hummingbird-project.containerfile` label contains the path to the Containerfile source relative to the repository root (e.g., `images/caddy/hummingbird/default/Containerfile`). A full URL to the source can be constructed from `org.opencontainers.image.source` + `org.opencontainers.image.revision` + this path. ## Embedded Metadata (labels.json) All labels are written to `/usr/share/buildinfo/labels.json` inside the container filesystem, providing filesystem-level access for security scanners. See [Security Labels and Metadata](security-labels-and-metadata.md) for schema details. ## Related Files | File | Purpose | |----------------------------------------------------|------------------------------------------------| | `images//properties.yml` | Per-image metadata fields | | `ci/internal/generate_jinja2.py` | Builds `inject_labels` dict from properties | | `macros/image_metadata_labels.yml.j2` | Emits LABEL instructions from `inject_labels` | | `macros/inject_source_info_labels.yml.j2` | Emits `name` and `cpe` LABEL instructions | | `macros/install_newroot.yml.j2` | Invokes `inject-source-info.sh` with labels | | `images/hummingbird-builder/inject-source-info.sh` | Writes `labels.json` to container filesystem | | `ci/build_images.sh` | Adds build-time labels | | `ci/check_release_fields.py` | Validates label field values in properties.yml | [conforma-labels]: https://conforma.dev/docs/policy/packages/release_labels.html [rule-data]: https://github.com/release-engineering/rhtap-ec-policy/blob/main/data/rule_data.yml [oci-spec]: https://github.com/opencontainers/image-spec/blob/main/annotations.md [security-schema]: https://github.com/RedHatProductSecurity/security-data-guidelines/blob/main/schema/embedded_metadata.v1.schema.json [ubi-eula]: https://www.redhat.com/en/about/red-hat-end-user-license-agreements#UBI