<labels> block silently ignored when <buildx> is configured

[michaeftapi]

Summary

When an image's <build> configuration includes both a <labels> element and a <buildx> element (multi-platform build), the labels are silently dropped — they appear nowhere in the resulting image's Config.Labels. Classic (non-buildx) builds in the same project correctly honour <labels>.

Versions

• Reproduced on 0.45.1
• Source-verified still present on 0.48.1 (current latest at time of writing)

Reproduction

Minimal pom.xml snippet:

<image>
  <name>example/foo:latest</name>
  <build>
    <buildx>
      <platforms>
        <platform>linux/amd64</platform>
        <platform>linux/arm64</platform>
      </platforms>
    </buildx>
    <dockerFileDir>${project.basedir}/src/main/docker</dockerFileDir>
    <labels>
      <org.opencontainers.image.title>Example</org.opencontainers.image.title>
      <org.opencontainers.image.vendor>Example GmbH</org.opencontainers.image.vendor>
      <org.opencontainers.image.version>1.0.0</org.opencontainers.image.version>
    </labels>
  </build>
</image>

Run mvn docker:build, then inspect:

docker inspect example/foo:latest --format '{{json .Config.Labels}}'

Expected: the three org.opencontainers.image.* labels appear in the output.
Actual: null (no Labels key emitted at all).

Removing the <buildx> element so the same image goes through the classic build path makes the labels appear as expected.

Root cause

io.fabric8.maven.docker.service.BuildXService.buildX(...) constructs the docker buildx build command line and emits flags for --platform, --tag, --build-arg, --no-cache, --sbom, --provenance, --cache-from, --cache-to, --secret, --squash — but never calls BuildImageConfiguration.getLabels() and never appends --label flags. Confirmed by source inspection on the v0.48.1 tag.

Expected behaviour

<labels> should be propagated to docker buildx build as one --label key=value flag per entry, matching the behaviour of the classic build path. This is important for org.opencontainers.image.* metadata (title / vendor / source / revision / version / licenses) that registry tooling, CVE scanners, and supply-chain audit tools all read from image-config labels.

Workaround

For now, projects either:

1. Add LABEL instructions in the Dockerfile with ARG-plumbed values (fragmenting the label set away from the rest of the d-m-p config), or
2. Accept that buildx-built images go unlabelled.

Happy to put together a PR if there's appetite — the fix looks like a small addition to the buildx command construction in BuildXService.