Harden immutable release deployment

deploy/unraid/Dockerfile.all-in-one

@@ -12,13 +12,9 @@ ARG GEOINTEL_INSTALL_AI=false
 ARG GEOINTEL_TORCH_INDEX_URL=https://download.pytorch.org/whl/cpu
 ARG GEOINTEL_TORCH_VERSION=2.13.0
 ARG GEOINTEL_TORCHVISION_VERSION=0.28.0
-ARG GEOINTEL_BUILD_SHA=unknown
-ARG GEOINTEL_BUILD_TIME=unknown
 
 ENV GEOINTEL_ENV=production \
     GEOINTEL_API_PREFIX=/api/v1 \
-    GEOINTEL_BUILD_SHA="${GEOINTEL_BUILD_SHA}" \
-    GEOINTEL_BUILD_TIME="${GEOINTEL_BUILD_TIME}" \
     GEOINTEL_STORAGE_ROOT=/app/storage \
     STORAGE_ROOT=/app/storage \
     GEOINTEL_ALL_IN_ONE=1 \
@@ -154,6 +150,17 @@ RUN chmod +x /usr/local/bin/geointel-all-in-one-start \
       /app/scripts/run_background_corpus_split_matrix.sh \
       /app/scripts/run_split_background_promotion_workflow.sh
 
+ARG GEOINTEL_BUILD_SHA=unknown
+ARG GEOINTEL_BUILD_TIME=unknown
+
+ENV GEOINTEL_BUILD_SHA="${GEOINTEL_BUILD_SHA}" \
+    GEOINTEL_BUILD_TIME="${GEOINTEL_BUILD_TIME}"
+
+LABEL org.opencontainers.image.title="GeoIntel" \
+      org.opencontainers.image.description="GeoIntel workbench for Belgium and the Belgian North Sea" \
+      org.opencontainers.image.revision="${GEOINTEL_BUILD_SHA}" \
+      org.opencontainers.image.created="${GEOINTEL_BUILD_TIME}"
+
 VOLUME ["/var/lib/postgresql/data", "/app/storage"]
 
 EXPOSE 80