The image contains the service code; APP_LABEL is supplied at run time. The application listens inside the container, while an explicit loopback port mapping exposes it only for local review. A successful health response verifies more than container status alone.

Critical check: The build context excludes unrelated files and secrets, and the demonstrated service remains a clearly scoped local exercise.

Final project: Deliver the service, Dockerfile, ignore file, Compose file, README and observed run evidence. Rebuild after a harmless response change and explain why an existing container does not automatically adopt the new image.