fix(docker): add .dockerignore to tighten build context - #109
Conversation
Project root had no .dockerignore (confirmed). docker-compose.ci.yml uses build.context: "." for console/management/backend, so the entire repo — .git, wiki/, docs/, host node_modules/, target/, local .env — was being sent to the daemon as build context for every image: slow builds plus the risk of local secrets landing in an image layer. Build context stays "." (monorepo: console/management Dockerfiles need COPY shared/, shared/ lives at repo root). This file excludes: - VCS / IDE / agent configs (.git, .claude, .cursor, .codex, .agents, ...) - docs & wiki (rebuilt from sources, not needed in any image) - build artifacts (**/node_modules, **/dist, **/target, **/coverage, ...) - local secrets (.env*, except .env.example) - tooling/infra (infrastructure, tools, scripts) and standalone image contexts (init-db, docker/sandbox) - deploy orchestration (docker-compose*.yml, ecosystem.config.cjs) Verified: critical build paths (console/management/shared/backend-spring + their package.json/pnpm-lock.yaml/mvnw/src/public) remain visible to the context. Fixes #103
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 41a57ce537
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| .env | ||
| .env.* |
There was a problem hiding this comment.
When a developer builds the console or management images from a checkout containing console/.env.local, console/.env.production.local, or similar app-local dotenv files, these patterns only cover dotenv files at the root of the build context; the Docker docs note that a bare glob such as *.md applies only right under the context directory. Since the frontend Dockerfiles use COPY console ./console / COPY management ./management before pnpm build, those local env files can still be sent to the daemon, stored in build cache, or influence the Vite bundle. Use recursive patterns such as **/.env and **/.env.* with explicit example-file exceptions.
Useful? React with 👍 / 👎.
1 participant
Project root had no
.dockerignore. Withdocker-compose.ci.ymlusingbuild.context: "."for all three app images, the entire repo (.git,wiki/,docs/, hostnode_modules/,target/, local.env) was sent to the daemon per build — slow + risk of local secrets entering image layers.Excludes VCS/IDE/docs/build-artifacts/secrets/tooling/standalone-image-contexts. Build-critical paths (
console/management/shared/backend-spring+ theirpackage.json/pnpm-lock.yaml/mvnw/src/public) verified preserved. Saves ~173M of context transfer.Closes #103