20260710 安装包重建提交标识镜像

2026-07-10 16:00:51 +08:00 · 2026-07-10 16:00:51 +08:00 · ea6ac27b8d
commit ea6ac27b8d
parent de4f40eb2c
10 changed files with 182 additions and 103 deletions
--- a/deploy/docker-installer/.env.example
+++ b/deploy/docker-installer/.env.example
@ -11,12 +11,12 @@ ALLOW_CROSS_ARCH=0
 # Compose project name.
 COMPOSE_PROJECT_NAME=ours-rp-__PACKAGE_ARCH__-installer

-# Runtime image loaded from images/*.tar.gz by install.sh.
-RPKI_IMAGE=ours-rp-runtime-__PACKAGE_ARCH__:dev
+# Runtime image rebuilt from the current source commit while packaging.
+RPKI_IMAGE=__RUNTIME_IMAGE__
 RPKI_PLATFORM=__PACKAGE_PLATFORM__

-# Metrics image loaded from images/*.tar.gz by install.sh.
-METRICS_IMAGE=ours-rp-metrics-__PACKAGE_ARCH__:dev
+# Metrics image rebuilt from the current source commit while packaging.
+METRICS_IMAGE=__METRICS_IMAGE__
 METRICS_PLATFORM=__PACKAGE_PLATFORM__

 # Restart policy for the soak container. Production default keeps the daemon alive.
--- a/deploy/docker-installer/docs/README.en.md
+++ b/deploy/docker-installer/docs/README.en.md
@ -6,6 +6,8 @@ This package deploys ours RP on Linux servers whose host architecture matches th

 The package includes four architecture-matched images: ours RP runtime, artifact metrics, Prometheus, and Grafana. Deployment does not need to pull application images on the target host. Runtime state, run artifacts, logs, Prometheus data and Grafana data are persisted through host bind mounts.

+Every installer build rebuilds the ours RP runtime and artifact metrics images. The deliverable name is `ours-rp-installer-{arch}-{git8}-{YYYYMMDDTHHMMSSZ}.tar.gz`, and both ours RP image tags use the current source commit. `PACKAGE-MANIFEST.env` records the full commit, UTC build time, dirty state, and image archive hashes; `./status.sh --brief` displays that provenance after installation.
+
 By default the host architecture must match `PACKAGE_ARCH` from `PACKAGE-MANIFEST.env`. If you intentionally want to run this package on a different host architecture through QEMU/binfmt, set:

 ```bash
@ -21,8 +23,8 @@ The legacy direct Compose deployment entry point has been removed. For either am
 ## Quick Start

 ```bash
-tar -xzf ours-rp-docker-installer-__PACKAGE_ARCH__-*.tar.gz
-cd ours-rp-docker-installer-__PACKAGE_ARCH__-*
+tar -xzf ours-rp-installer-__PACKAGE_ARCH__-*.tar.gz
+cd ours-rp-installer-__PACKAGE_ARCH__-*

 ./install.sh
 cp .env.example .env   # install.sh creates .env automatically if missing
@ -45,8 +47,8 @@ Defaults:
 - `PERIODIC_SNAPSHOT_MAX_DELTAS=100`
 - `HOST_DATA_DIR=__HOST_DATA_DIR__`
 - `SOAK_RESTART_POLICY=unless-stopped`
- `RPKI_IMAGE=ours-rp-runtime-__PACKAGE_ARCH__:dev`
- `METRICS_IMAGE=ours-rp-metrics-__PACKAGE_ARCH__:dev`
+- `RPKI_IMAGE=__RUNTIME_IMAGE__`
+- `METRICS_IMAGE=__METRICS_IMAGE__`
 - `METRICS_PLATFORM=__PACKAGE_PLATFORM__`
 - `MONITOR_PLATFORM=__PACKAGE_PLATFORM__`
 - `ALLOW_CROSS_ARCH=0`
--- a/deploy/docker-installer/docs/README.zh-CN.md
+++ b/deploy/docker-installer/docs/README.zh-CN.md
@ -6,6 +6,8 @@

 安装包内置与包架构一致的四类镜像：ours RP runtime、artifact metrics、Prometheus、Grafana。部署时不需要现场拉取应用镜像。运行产物、状态数据库、日志、Prometheus 和 Grafana 数据均通过宿主机目录挂载保存。

+每次构建安装包都会重新构建 ours RP runtime 与 artifact metrics 镜像。交付包命名为 `ours-rp-installer-{arch}-{git8}-{YYYYMMDDTHHMMSSZ}.tar.gz`，两类 ours RP 镜像分别使用当前源码 commit 的 tag。完整 commit、UTC 构建时间、dirty 状态和镜像归档 hash 保存在 `PACKAGE-MANIFEST.env`，可通过 `./status.sh --brief` 查看。
+
 默认情况下，宿主架构必须与 `PACKAGE-MANIFEST.env` 中的 `PACKAGE_ARCH` 匹配；若确需在异构主机上通过 QEMU/binfmt 运行，必须显式设置：

 ```bash
@ -21,8 +23,8 @@ ALLOW_CROSS_ARCH=1
 ## 快速开始

 ```bash
-tar -xzf ours-rp-docker-installer-__PACKAGE_ARCH__-*.tar.gz
-cd ours-rp-docker-installer-__PACKAGE_ARCH__-*
+tar -xzf ours-rp-installer-__PACKAGE_ARCH__-*.tar.gz
+cd ours-rp-installer-__PACKAGE_ARCH__-*

 ./install.sh
 cp .env.example .env   # 如 install.sh 已自动创建，可直接编辑现有 .env
@ -45,8 +47,8 @@ vim .env
 - `PERIODIC_SNAPSHOT_MAX_DELTAS=100`
 - `HOST_DATA_DIR=__HOST_DATA_DIR__`
 - `SOAK_RESTART_POLICY=unless-stopped`
- `RPKI_IMAGE=ours-rp-runtime-__PACKAGE_ARCH__:dev`
- `METRICS_IMAGE=ours-rp-metrics-__PACKAGE_ARCH__:dev`
+- `RPKI_IMAGE=__RUNTIME_IMAGE__`
+- `METRICS_IMAGE=__METRICS_IMAGE__`
 - `METRICS_PLATFORM=__PACKAGE_PLATFORM__`
 - `MONITOR_PLATFORM=__PACKAGE_PLATFORM__`
 - `ALLOW_CROSS_ARCH=0`
--- a/deploy/docker-installer/scripts/common.sh
+++ b/deploy/docker-installer/scripts/common.sh
@ -192,9 +192,9 @@ load_env() {

  HOST_DATA_DIR="${HOST_DATA_DIR:-/var/lib/ours-rp-${PACKAGE_ARCH}-installer}"
  COMPOSE_PROJECT_NAME="${COMPOSE_PROJECT_NAME:-ours-rp-${PACKAGE_ARCH}-installer}"
-  RPKI_IMAGE="${RPKI_IMAGE:-ours-rp-runtime-${PACKAGE_ARCH}:dev}"
+  RPKI_IMAGE="${RPKI_IMAGE:-ours-rp-runtime-${PACKAGE_ARCH}:${source_commit_short:-unknown}}"
  RPKI_PLATFORM="${RPKI_PLATFORM:-$PACKAGE_PLATFORM}"
-  METRICS_IMAGE="${METRICS_IMAGE:-ours-rp-metrics-${PACKAGE_ARCH}:dev}"
+  METRICS_IMAGE="${METRICS_IMAGE:-ours-rp-metrics-${PACKAGE_ARCH}:${source_commit_short:-unknown}}"
  METRICS_PLATFORM="${METRICS_PLATFORM:-$PACKAGE_PLATFORM}"
  RTR_REPORT_DIR="${RTR_REPORT_DIR:-$HOST_DATA_DIR/empty-rtr-report}"
  RTR_REPORT_CONTAINER_DIR="${RTR_REPORT_CONTAINER_DIR:-/var/lib/ours-rp/rtr-report}"
--- a/deploy/docker-installer/status.sh
+++ b/deploy/docker-installer/status.sh
@ -26,6 +26,11 @@ host_arch="$(detect_host_arch)"
 mode="$(arch_mode)"
 echo "installer_root=$INSTALLER_ROOT"
 echo "manifest_file=$MANIFEST_FILE"
+echo "package_name=${package_name:-}"
+echo "source_commit=${source_commit:-${git_commit:-}}"
+echo "source_commit_short=${source_commit_short:-}"
+echo "source_dirty=${source_dirty:-}"
+echo "build_timestamp_utc=${build_timestamp_utc:-${created_at_utc:-}}"
 echo "host_data_dir=$HOST_DATA_DIR"
 echo "host_arch=$host_arch"
 echo "package_arch=$PACKAGE_ARCH"
@ -34,8 +39,12 @@ echo "allow_cross_arch=$ALLOW_CROSS_ARCH"
 echo "arch_mode=$mode"
 echo "runtime_image=$RPKI_IMAGE"
 echo "runtime_platform=$RPKI_PLATFORM"
+echo "runtime_image_revision=${runtime_image_revision:-}"
+echo "runtime_image_dirty=${runtime_image_dirty:-}"
 echo "metrics_image=$METRICS_IMAGE"
 echo "metrics_platform=$METRICS_PLATFORM"
+echo "metrics_image_revision=${metrics_image_revision:-}"
+echo "metrics_image_dirty=${metrics_image_dirty:-}"
 echo "rtr_report_dir=$RTR_REPORT_DIR"
 echo "rtr_report_container_dir=$RTR_REPORT_CONTAINER_DIR"
 echo "monitor_platform=$MONITOR_PLATFORM"
--- a/docker/ours-rp-metrics.Dockerfile
+++ b/docker/ours-rp-metrics.Dockerfile
@ -87,8 +87,15 @@ RUN --mount=type=cache,target=/usr/local/cargo/registry \

 FROM --platform=$TARGETPLATFORM ${RUNTIME_IMAGE} AS runtime

+ARG SOURCE_COMMIT=unknown
+ARG SOURCE_DIRTY=unknown
+ARG BUILD_TIMESTAMP_UTC=unknown
+
 LABEL org.opencontainers.image.title="ours-rp-metrics" \
-      org.opencontainers.image.description="Ours RP artifact metrics image for multi-arch Docker Compose deployment"
+      org.opencontainers.image.description="Ours RP artifact metrics image for multi-arch Docker Compose deployment" \
+      org.opencontainers.image.revision="${SOURCE_COMMIT}" \
+      org.opencontainers.image.created="${BUILD_TIMESTAMP_UTC}" \
+      org.opencontainers.image.source-dirty="${SOURCE_DIRTY}"

 RUN apt-get update \
    && apt-get install -y --no-install-recommends \
--- a/docker/ours-rp-runtime.Dockerfile
+++ b/docker/ours-rp-runtime.Dockerfile
@ -94,8 +94,15 @@ RUN --mount=type=cache,target=/usr/local/cargo/registry \

 FROM --platform=$TARGETPLATFORM ${RUNTIME_IMAGE} AS runtime

+ARG SOURCE_COMMIT=unknown
+ARG SOURCE_DIRTY=unknown
+ARG BUILD_TIMESTAMP_UTC=unknown
+
 LABEL org.opencontainers.image.title="ours-rp-runtime" \
-      org.opencontainers.image.description="Ours RP runtime image for multi-arch Docker Compose deployment"
+      org.opencontainers.image.description="Ours RP runtime image for multi-arch Docker Compose deployment" \
+      org.opencontainers.image.revision="${SOURCE_COMMIT}" \
+      org.opencontainers.image.created="${BUILD_TIMESTAMP_UTC}" \
+      org.opencontainers.image.source-dirty="${SOURCE_DIRTY}"

 RUN apt-get update \
    && apt-get install -y --no-install-recommends \
--- a/scripts/docker/build_docker_installer_package.sh
+++ b/scripts/docker/build_docker_installer_package.sh
@ -5,10 +5,10 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 REPO_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"

 TARGET_ARCH="${TARGET_ARCH:-}"
-IMAGE_TAG="${IMAGE_TAG:-}"
-IMAGE_TAR="${IMAGE_TAR:-}"
-METRICS_IMAGE="${METRICS_IMAGE:-}"
-METRICS_IMAGE_TAR="${METRICS_IMAGE_TAR:-}"
+IMAGE_TAG=""
+IMAGE_TAR=""
+METRICS_IMAGE=""
+METRICS_IMAGE_TAR=""
 PROMETHEUS_IMAGE="${PROMETHEUS_IMAGE:-prom/prometheus:v2.55.1}"
 PROMETHEUS_IMAGE_TAR="${PROMETHEUS_IMAGE_TAR:-}"
 GRAFANA_IMAGE="${GRAFANA_IMAGE:-grafana/grafana:11.3.1}"
@ -16,6 +16,7 @@ GRAFANA_IMAGE_TAR="${GRAFANA_IMAGE_TAR:-}"
 OUT_DIR="${OUT_DIR:-}"
 PACKAGE_PREFIX="${PACKAGE_PREFIX:-}"
 TEMPLATE_DIR="${TEMPLATE_DIR:-$REPO_ROOT/deploy/docker-installer}"
+ALLOW_DIRTY=0

 usage() {
  cat <<'USAGE'
@ -24,12 +25,6 @@ Usage:

 Options:
  --arch <arch>       Target architecture: amd64|arm64
-  --image <tag>       Runtime image tag recorded in package manifest.
-  --image-tar <path>  Existing docker save tar/tar.gz to include.
-  --metrics-image <tag>
-                      Metrics image tag recorded in package manifest.
-  --metrics-image-tar <path>
-                      Existing metrics docker save tar/tar.gz to include.
  --prometheus-image <tag>
                      Prometheus image tag to record and package.
  --prometheus-image-tar <path>
@ -42,10 +37,13 @@ Options:
  --prefix <name>     Package directory/tar prefix.
  --template-dir <path>
                      Package template directory.
+  --allow-dirty       Allow a development build from a dirty worktree and mark
+                      image tags, package name and manifest as dirty.
  -h, --help          Show help.

-If --image-tar or --metrics-image-tar is omitted, the script uses the
-matching docker-save archive under target/<arch>-docker/.
+Every package rebuilds runtime and metrics images from the current HEAD. Their
+tags are ours-rp-runtime-<arch>:<git8> and ours-rp-metrics-<arch>:<git8>.
+External runtime/metrics image tags and tar archives are intentionally rejected.
 USAGE
 }

@ -71,16 +69,20 @@ safe_tag_name() {
  printf '%s' "$1" | tr '/:' '--'
 }

-default_runtime_tag() {
-  printf 'ours-rp-runtime-%s:dev\n' "$1"
+runtime_image_tag() {
+  local arch="$1"
+  local revision="$2"
+  printf 'ours-rp-runtime-%s:%s\n' "$arch" "$revision"
 }

-default_metrics_tag() {
-  printf 'ours-rp-metrics-%s:dev\n' "$1"
+metrics_image_tag() {
+  local arch="$1"
+  local revision="$2"
+  printf 'ours-rp-metrics-%s:%s\n' "$arch" "$revision"
 }

 default_package_prefix() {
-  printf 'ours-rp-docker-installer-%s\n' "$1"
+  printf 'ours-rp-installer-%s\n' "$1"
 }

 default_host_data_dir() {
@ -163,20 +165,10 @@ save_image_if_needed() {
  printf '%s\n' "$tar_path"
 }

-default_saved_image_tar() {
+image_label() {
  local image="$1"
-  local out_dir="$REPO_ROOT/target/${TARGET_ARCH}-docker"
-  local safe_name
-  safe_name="$(safe_tag_name "$image")"
-  if [[ -f "$out_dir/${safe_name}.tar.gz" ]]; then
-    printf '%s\n' "$out_dir/${safe_name}.tar.gz"
-    return 0
-  fi
-  if [[ -f "$out_dir/${safe_name}.tar" ]]; then
-    printf '%s\n' "$out_dir/${safe_name}.tar"
-    return 0
-  fi
-  printf '\n'
+  local key="$2"
+  docker image inspect --format "{{ index .Config.Labels \"$key\" }}" "$image"
 }

 while [[ $# -gt 0 ]]; do
@ -188,21 +180,9 @@ while [[ $# -gt 0 ]]; do
      }
      shift 2
      ;;
-    --image)
-      IMAGE_TAG="$2"
-      shift 2
-      ;;
-    --image-tar)
-      IMAGE_TAR="$2"
-      shift 2
-      ;;
-    --metrics-image)
-      METRICS_IMAGE="$2"
-      shift 2
-      ;;
-    --metrics-image-tar)
-      METRICS_IMAGE_TAR="$2"
-      shift 2
+    --image|--image-tar|--metrics-image|--metrics-image-tar)
+      echo "$1 is no longer supported: installer packages always rebuild runtime and metrics images from current HEAD" >&2
+      exit 2
      ;;
    --prometheus-image)
      PROMETHEUS_IMAGE="$2"
@ -232,6 +212,10 @@ while [[ $# -gt 0 ]]; do
      TEMPLATE_DIR="$2"
      shift 2
      ;;
+    --allow-dirty)
+      ALLOW_DIRTY=1
+      shift
+      ;;
    -h|--help)
      usage
      exit 0
@ -255,12 +239,28 @@ done
  exit 2
 }

-if [[ -z "$IMAGE_TAG" ]]; then
-  IMAGE_TAG="$(default_runtime_tag "$TARGET_ARCH")"
+SOURCE_COMMIT_FULL="$(git -C "$REPO_ROOT" rev-parse HEAD)"
+SOURCE_COMMIT_SHORT="$(git -C "$REPO_ROOT" rev-parse --short=8 HEAD)"
+SOURCE_DIRTY="false"
+if [[ -n "$(git -C "$REPO_ROOT" status --short)" ]]; then
+  SOURCE_DIRTY="true"
 fi
-if [[ -z "$METRICS_IMAGE" ]]; then
-  METRICS_IMAGE="$(default_metrics_tag "$TARGET_ARCH")"
+if [[ "$SOURCE_DIRTY" == "true" && "$ALLOW_DIRTY" != "1" ]]; then
+  cat >&2 <<EOF
+refusing to build a release installer from a dirty worktree.
+  source_commit: $SOURCE_COMMIT_FULL
+Use --allow-dirty only for development verification; the package and image tags
+will be explicitly marked dirty.
+EOF
+  exit 2
 fi
+TIMESTAMP="$(date -u +%Y%m%dT%H%M%SZ)"
+REVISION_TOKEN="$SOURCE_COMMIT_SHORT"
+if [[ "$SOURCE_DIRTY" == "true" ]]; then
+  REVISION_TOKEN="${REVISION_TOKEN}-dirty"
+fi
+IMAGE_TAG="$(runtime_image_tag "$TARGET_ARCH" "$REVISION_TOKEN")"
+METRICS_IMAGE="$(metrics_image_tag "$TARGET_ARCH" "$REVISION_TOKEN")"
 if [[ -z "$OUT_DIR" ]]; then
  OUT_DIR="$REPO_ROOT/target/${TARGET_ARCH}-installer"
 fi
@ -272,37 +272,35 @@ TARGET_PLATFORM="$(platform_for_arch "$TARGET_ARCH")"
 HOST_DATA_DIR_DEFAULT="$(default_host_data_dir "$TARGET_ARCH")"
 COMPOSE_PROJECT_DEFAULT="$(default_compose_project "$TARGET_ARCH")"
 METRICS_INSTANCE_DEFAULT="$(default_metrics_instance "$TARGET_ARCH")"
-
-if [[ -z "$IMAGE_TAR" ]]; then
-  IMAGE_TAR="$(default_saved_image_tar "$IMAGE_TAG")"
-fi
-if [[ -z "$METRICS_IMAGE_TAR" ]]; then
-  METRICS_IMAGE_TAR="$(default_saved_image_tar "$METRICS_IMAGE")"
-fi
-
-[[ -n "$IMAGE_TAR" && -f "$IMAGE_TAR" ]] || {
-  cat >&2 <<EOF
-missing runtime image tar for $TARGET_ARCH.
-
-Build one first, for example:
-  scripts/docker/build_docker_runtime_image.sh --arch $TARGET_ARCH --image $IMAGE_TAG
-EOF
-  exit 2
-}
-[[ -n "$METRICS_IMAGE_TAR" && -f "$METRICS_IMAGE_TAR" ]] || {
-  cat >&2 <<EOF
-missing metrics image tar for $TARGET_ARCH.
-
-Build one first, for example:
-  scripts/docker/build_docker_metrics_image.sh --arch $TARGET_ARCH --image $METRICS_IMAGE
-EOF
-  exit 2
-}
+IMAGE_OUT_DIR="$REPO_ROOT/target/${TARGET_ARCH}-docker"

 mkdir -p "$OUT_DIR"
-commit="$(git -C "$REPO_ROOT" rev-parse --short HEAD 2>/dev/null || echo unknown)"
-timestamp="$(date -u +%Y%m%dT%H%M%SZ)"
-package_name="${PACKAGE_PREFIX}-${timestamp}-${commit}"
+echo "rebuilding runtime image: $IMAGE_TAG"
+"$SCRIPT_DIR/build_docker_runtime_image.sh" \
+  --arch "$TARGET_ARCH" \
+  --image "$IMAGE_TAG" \
+  --out-dir "$IMAGE_OUT_DIR"
+echo "rebuilding metrics image: $METRICS_IMAGE"
+"$SCRIPT_DIR/build_docker_metrics_image.sh" \
+  --arch "$TARGET_ARCH" \
+  --image "$METRICS_IMAGE" \
+  --out-dir "$IMAGE_OUT_DIR"
+
+IMAGE_TAR="$IMAGE_OUT_DIR/$(safe_tag_name "$IMAGE_TAG").tar.gz"
+METRICS_IMAGE_TAR="$IMAGE_OUT_DIR/$(safe_tag_name "$METRICS_IMAGE").tar.gz"
+[[ -f "$IMAGE_TAR" ]] || { echo "runtime image build did not produce $IMAGE_TAR" >&2; exit 2; }
+[[ -f "$METRICS_IMAGE_TAR" ]] || { echo "metrics image build did not produce $METRICS_IMAGE_TAR" >&2; exit 2; }
+
+runtime_image_revision="$(image_label "$IMAGE_TAG" "org.opencontainers.image.revision")"
+metrics_image_revision="$(image_label "$METRICS_IMAGE" "org.opencontainers.image.revision")"
+runtime_image_dirty="$(image_label "$IMAGE_TAG" "org.opencontainers.image.source-dirty")"
+metrics_image_dirty="$(image_label "$METRICS_IMAGE" "org.opencontainers.image.source-dirty")"
+[[ "$runtime_image_revision" == "$SOURCE_COMMIT_FULL" ]] || { echo "runtime image revision mismatch: $runtime_image_revision != $SOURCE_COMMIT_FULL" >&2; exit 2; }
+[[ "$metrics_image_revision" == "$SOURCE_COMMIT_FULL" ]] || { echo "metrics image revision mismatch: $metrics_image_revision != $SOURCE_COMMIT_FULL" >&2; exit 2; }
+[[ "$runtime_image_dirty" == "$SOURCE_DIRTY" ]] || { echo "runtime image dirty flag mismatch" >&2; exit 2; }
+[[ "$metrics_image_dirty" == "$SOURCE_DIRTY" ]] || { echo "metrics image dirty flag mismatch" >&2; exit 2; }
+
+package_name="${PACKAGE_PREFIX}-${REVISION_TOKEN}-${TIMESTAMP}"
 stage="$OUT_DIR/$package_name"
 tar_path="$OUT_DIR/$package_name.tar.gz"

@ -312,7 +310,7 @@ mkdir -p "$stage/images"
 cp "$IMAGE_TAR" "$stage/images/"
 cp "$METRICS_IMAGE_TAR" "$stage/images/"

-monitor_image_stage="$OUT_DIR/.monitor-images-$TARGET_ARCH-$timestamp"
+monitor_image_stage="$OUT_DIR/.monitor-images-$TARGET_ARCH-$TIMESTAMP"
 rm -rf "$monitor_image_stage"
 mkdir -p "$monitor_image_stage"
 prometheus_tar="$(save_image_if_needed "$PROMETHEUS_IMAGE" "$PROMETHEUS_IMAGE_TAR" "$monitor_image_stage" "prometheus" "$TARGET_PLATFORM")"
@ -354,6 +352,10 @@ replace_text_in_file "$stage/docs/operations.zh-CN.md" "__HOST_DATA_DIR__" "$HOS
 replace_text_in_file "$stage/docs/operations.en.md" "__HOST_DATA_DIR__" "$HOST_DATA_DIR_DEFAULT"
 replace_text_in_file "$stage/docs/troubleshooting.zh-CN.md" "__HOST_DATA_DIR__" "$HOST_DATA_DIR_DEFAULT"
 replace_text_in_file "$stage/docs/troubleshooting.en.md" "__HOST_DATA_DIR__" "$HOST_DATA_DIR_DEFAULT"
+replace_text_in_file "$stage/docs/README.zh-CN.md" "__RUNTIME_IMAGE__" "$IMAGE_TAG"
+replace_text_in_file "$stage/docs/README.en.md" "__RUNTIME_IMAGE__" "$IMAGE_TAG"
+replace_text_in_file "$stage/docs/README.zh-CN.md" "__METRICS_IMAGE__" "$METRICS_IMAGE"
+replace_text_in_file "$stage/docs/README.en.md" "__METRICS_IMAGE__" "$METRICS_IMAGE"

 runtime_tar_sha256="$(sha256sum "$IMAGE_TAR" | awk '{print $1}')"
 metrics_tar_sha256="$(sha256sum "$METRICS_IMAGE_TAR" | awk '{print $1}')"
@ -361,9 +363,14 @@ prometheus_tar_sha256="$(sha256sum "$prometheus_tar" | awk '{print $1}')"
 grafana_tar_sha256="$(sha256sum "$grafana_tar" | awk '{print $1}')"

 cat > "$stage/PACKAGE-MANIFEST.env" <<EOF
+package_schema_version=2
 package_name=$package_name
-created_at_utc=$timestamp
-git_commit=$commit
+created_at_utc=$TIMESTAMP
+build_timestamp_utc=$TIMESTAMP
+source_commit=$SOURCE_COMMIT_FULL
+source_commit_short=$SOURCE_COMMIT_SHORT
+source_dirty=$SOURCE_DIRTY
+git_commit=$SOURCE_COMMIT_FULL
 git_status_count=$(git -C "$REPO_ROOT" status --short 2>/dev/null | wc -l | tr -d ' ')
 PACKAGE_ARCH=$TARGET_ARCH
 PACKAGE_PLATFORM=$TARGET_PLATFORM
@ -377,6 +384,8 @@ image_tag=$IMAGE_TAG
 image_tar=$(basename "$IMAGE_TAR")
 image_tar_size_bytes=$(wc -c < "$IMAGE_TAR")
 image_tar_sha256=$runtime_tar_sha256
+runtime_image_revision=$runtime_image_revision
+runtime_image_dirty=$runtime_image_dirty
 rpki_image=$IMAGE_TAG
 rpki_platform=$TARGET_PLATFORM
 METRICS_IMAGE=$METRICS_IMAGE
@ -385,6 +394,8 @@ metrics_image=$METRICS_IMAGE
 metrics_image_tar=$(basename "$METRICS_IMAGE_TAR")
 metrics_image_tar_size_bytes=$(wc -c < "$METRICS_IMAGE_TAR")
 metrics_image_tar_sha256=$metrics_tar_sha256
+metrics_image_revision=$metrics_image_revision
+metrics_image_dirty=$metrics_image_dirty
 PROMETHEUS_IMAGE=$PROMETHEUS_IMAGE
 prometheus_image=$PROMETHEUS_IMAGE
 prometheus_image_tar=$(basename "$prometheus_tar")
@ -407,10 +418,16 @@ EOF

 cat > "$stage/PACKAGE-SUMMARY.txt" <<EOF
 package_name: $package_name
+source_commit: $SOURCE_COMMIT_FULL
+source_commit_short: $SOURCE_COMMIT_SHORT
+source_dirty: $SOURCE_DIRTY
+build_timestamp_utc: $TIMESTAMP
 package_arch: $TARGET_ARCH
 package_platform: $TARGET_PLATFORM
 runtime_image: $IMAGE_TAG
+runtime_image_revision: $runtime_image_revision
 metrics_image: $METRICS_IMAGE
+metrics_image_revision: $metrics_image_revision
 prometheus_image: $PROMETHEUS_IMAGE
 grafana_image: $GRAFANA_IMAGE
 default_host_data_dir: $HOST_DATA_DIR_DEFAULT
@ -429,6 +446,10 @@ rm -rf "$monitor_image_stage"
  echo "package_dir=$stage"
  echo "package_size_bytes=$(wc -c < "$tar_path")"
  echo "package_sha256=$package_sha256"
+  echo "source_commit=$SOURCE_COMMIT_FULL"
+  echo "source_commit_short=$SOURCE_COMMIT_SHORT"
+  echo "source_dirty=$SOURCE_DIRTY"
+  echo "build_timestamp_utc=$TIMESTAMP"
  echo "package_arch=$TARGET_ARCH"
  echo "package_platform=$TARGET_PLATFORM"
  echo "manifest=$stage/PACKAGE-MANIFEST.env"
--- a/scripts/docker/build_docker_metrics_image.sh
+++ b/scripts/docker/build_docker_metrics_image.sh
@ -65,7 +65,11 @@ EOF
 fi

 if [[ -z "$IMAGE_TAG" ]]; then
-  IMAGE_TAG="ours-rp-metrics-${TARGET_ARCH}:dev"
+  SOURCE_COMMIT_SHORT="$(git -C "$REPO_ROOT" rev-parse --short=8 HEAD 2>/dev/null || echo unknown)"
+  if [[ -n "$(git -C "$REPO_ROOT" status --short 2>/dev/null)" ]]; then
+    SOURCE_COMMIT_SHORT="${SOURCE_COMMIT_SHORT}-dirty"
+  fi
+  IMAGE_TAG="ours-rp-metrics-${TARGET_ARCH}:${SOURCE_COMMIT_SHORT}"
 fi

 if [[ "$dockerfile_explicit" != "1" ]]; then
--- a/scripts/docker/build_docker_runtime_image.sh
+++ b/scripts/docker/build_docker_runtime_image.sh
@ -22,7 +22,7 @@ Usage:

 Options:
  --arch <arch>       Target architecture: amd64|arm64
-  --image <tag>       Docker image tag (default: ours-rp-runtime-<arch>:dev)
+  --image <tag>       Docker image tag (default: ours-rp-runtime-<arch>:<git8>)
  --out-dir <path>    Directory for docker save tar.gz (default: target/<arch>-docker)
  --dockerfile <path> Dockerfile path
  --builder <name>    buildx builder name
@ -60,7 +60,9 @@ platform_for_arch() {
 }

 default_image_tag() {
-  printf 'ours-rp-runtime-%s:dev\n' "$1"
+  local arch="$1"
+  local commit_short="$2"
+  printf 'ours-rp-runtime-%s:%s\n' "$arch" "$commit_short"
 }

 require_command() {
@ -142,8 +144,20 @@ done
  exit 2
 }

+SOURCE_COMMIT_FULL="$(git -C "$REPO_ROOT" rev-parse HEAD 2>/dev/null || echo unknown)"
+SOURCE_COMMIT_SHORT="$(git -C "$REPO_ROOT" rev-parse --short=8 HEAD 2>/dev/null || echo unknown)"
+SOURCE_DIRTY="false"
+if [[ -n "$(git -C "$REPO_ROOT" status --short 2>/dev/null)" ]]; then
+  SOURCE_DIRTY="true"
+fi
+BUILD_TIMESTAMP_UTC="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+
 if [[ -z "$IMAGE_TAG" ]]; then
-  IMAGE_TAG="$(default_image_tag "$TARGET_ARCH")"
+  default_revision="$SOURCE_COMMIT_SHORT"
+  if [[ "$SOURCE_DIRTY" == "true" ]]; then
+    default_revision="${default_revision}-dirty"
+  fi
+  IMAGE_TAG="$(default_image_tag "$TARGET_ARCH" "$default_revision")"
 fi
 if [[ -z "$OUT_DIR" ]]; then
  OUT_DIR="$REPO_ROOT/target/${TARGET_ARCH}-docker"
@ -176,6 +190,9 @@ echo "repo: $REPO_ROOT"
 echo "dockerfile: $DOCKERFILE"
 echo "builder_image: $BUILDER_IMAGE"
 echo "runtime_image: $RUNTIME_IMAGE"
+echo "source_commit: $SOURCE_COMMIT_FULL"
+echo "source_dirty: $SOURCE_DIRTY"
+echo "build_timestamp_utc: $BUILD_TIMESTAMP_UTC"
 start_epoch="$(date +%s)"

 if [[ "$LOAD_IMAGE" == "1" ]]; then
@ -186,6 +203,9 @@ if [[ "$LOAD_IMAGE" == "1" ]]; then
    --build-arg BUILDKIT_INLINE_CACHE=1 \
    --build-arg "BUILDER_IMAGE=$BUILDER_IMAGE" \
    --build-arg "RUNTIME_IMAGE=$RUNTIME_IMAGE" \
+    --build-arg "SOURCE_COMMIT=$SOURCE_COMMIT_FULL" \
+    --build-arg "SOURCE_DIRTY=$SOURCE_DIRTY" \
+    --build-arg "BUILD_TIMESTAMP_UTC=$BUILD_TIMESTAMP_UTC" \
    --metadata-file "$metadata_path" \
    -t "$IMAGE_TAG" \
    -f "$DOCKERFILE" \
@ -199,6 +219,9 @@ else
    --build-arg BUILDKIT_INLINE_CACHE=1 \
    --build-arg "BUILDER_IMAGE=$BUILDER_IMAGE" \
    --build-arg "RUNTIME_IMAGE=$RUNTIME_IMAGE" \
+    --build-arg "SOURCE_COMMIT=$SOURCE_COMMIT_FULL" \
+    --build-arg "SOURCE_DIRTY=$SOURCE_DIRTY" \
+    --build-arg "BUILD_TIMESTAMP_UTC=$BUILD_TIMESTAMP_UTC" \
    --metadata-file "$metadata_path" \
    -t "$IMAGE_TAG" \
    -f "$DOCKERFILE" \
@ -230,9 +253,13 @@ fi
  echo "tar=$tar_path"
  echo "tar_size_bytes=$(wc -c < "$tar_path" 2>/dev/null || echo 0)"
  echo "tar_sha256=$tar_sha256"
-  echo "git_commit=$(git -C "$REPO_ROOT" rev-parse --short HEAD 2>/dev/null || echo unknown)"
+  echo "source_commit=$SOURCE_COMMIT_FULL"
+  echo "source_commit_short=$SOURCE_COMMIT_SHORT"
+  echo "source_dirty=$SOURCE_DIRTY"
+  echo "build_timestamp_utc=$BUILD_TIMESTAMP_UTC"
+  echo "git_commit=$SOURCE_COMMIT_FULL"
  echo "git_status_count=$(git -C "$REPO_ROOT" status --short 2>/dev/null | wc -l | tr -d ' ')"
-  echo "built_at_utc=$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+  echo "built_at_utc=$BUILD_TIMESTAMP_UTC"
 } > "$OUT_DIR/$(safe_tag_name "$IMAGE_TAG").build-summary.env"

 echo "build complete: elapsed=${elapsed_secs}s tar=$tar_path"