diff --git a/CHANGELOG.md b/CHANGELOG.md
index ea6fd28f4..235fcf371 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,7 @@ The format is based on [Keep a Changelog](http://keepachangelog.com/).
 ## [Unreleased]
 
 ### Added
+- backend/docker: include arbitrary container labels from config
 
 ### Changed
 - backend/gce: add a `no-ip` tag when allocating instance without public IP
diff --git a/backend/docker.go b/backend/docker.go
index 5b5c0116b..94260c0de 100644
--- a/backend/docker.go
+++ b/backend/docker.go
@@ -5,7 +5,6 @@ import (
 	"bytes"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"net/http"
 	"net/url"
 	"path/filepath"
@@ -56,6 +55,7 @@ var (
 		"TMPFS_MAP":           fmt.Sprintf("space-delimited key:value map of tmpfs mounts (default %q)", defaultTmpfsMap),
 		"MEMORY":              "memory to allocate to each container (0 disables allocation, default \"4G\")",
 		"SHM":                 "/dev/shm to allocate to each container (0 disables allocation, default \"64MiB\")",
+		"CONTAINER_LABELS":    "\",\"-delimited key:value pairs of labels to apply to each container (default \"\")",
 		"CPUS":                "cpu count to allocate to each container (0 disables allocation, default 2)",
 		"CPU_SET_SIZE":        "size of available cpu set (default detected locally via runtime.NumCPU)",
 		"NATIVE":              "upload and run build script via docker API instead of over ssh (default false)",
@@ -97,6 +97,7 @@ type dockerProvider struct {
 	inspectInterval time.Duration
 	tmpFs           map[string]string
 	imageSelector   image.Selector
+	containerLabels map[string]string
 
 	cpuSetsMutex sync.Mutex
 	cpuSets      []bool
@@ -236,19 +237,25 @@ func newDockerProvider(cfg *config.ProviderConfig) (Provider, error) {
 		return nil, errors.Wrap(err, "couldn't build docker image selector")
 	}
 
+	containerLabels := map[string]string{}
+	if cfg.IsSet("CONTAINER_LABELS") {
+		containerLabels = str2map(cfg.Get("CONTAINER_LABELS"))
+	}
+
 	return &dockerProvider{
 		client:         client,
 		sshDialer:      sshDialer,
 		sshDialTimeout: sshDialTimeout,
 
-		runPrivileged: privileged,
-		runCmd:        cmd,
-		runBinds:      binds,
-		runMemory:     memory,
-		runShm:        shm,
-		runCPUs:       uint(cpus),
-		runNative:     runNative,
-		imageSelector: imageSelector,
+		runPrivileged:   privileged,
+		runCmd:          cmd,
+		runBinds:        binds,
+		runMemory:       memory,
+		runShm:          shm,
+		runCPUs:         uint(cpus),
+		runNative:       runNative,
+		imageSelector:   imageSelector,
+		containerLabels: containerLabels,
 
 		execCmd:         execCmd,
 		inspectInterval: inspectInterval,
@@ -377,6 +384,9 @@ func (p *dockerProvider) Start(ctx gocontext.Context, startAttributes *StartAttr
 	labels := map[string]string{
 		"travis.dist": startAttributes.Dist,
 	}
+	for key, value := range p.containerLabels {
+		labels[key] = value
+	}
 
 	r, ok := context.RepositoryFromContext(ctx)
 	if ok {
@@ -388,20 +398,6 @@ func (p *dockerProvider) Start(ctx gocontext.Context, startAttributes *StartAttr
 		labels["travis.job_id"] = strconv.FormatUint(jid, 10)
 	}
 
-	ipv4, err := ioutil.ReadFile("/var/tmp/travis-run.d/instance-ipv4")
-	if err != nil {
-		logger.WithField("err", err).Error("couldn't read instance IP from /var/tmp/travis-run.d/instance-ipv4")
-	} else {
-		labels["travis.ipv4"] = string(ipv4)
-	}
-
-	iid, err := ioutil.ReadFile("/var/tmp/travis-run.d/instance-id")
-	if err != nil {
-		logger.WithField("err", err).Error("couldn't read instance ID from /var/tmp/travis-run.d/instance-id")
-	} else {
-		labels["travis.instance_id"] = string(iid)
-	}
-
 	dockerConfig := &dockercontainer.Config{
 		Cmd:        p.runCmd,
 		Image:      imageID,