#377 - fix: add .dockerignore — stop baking .env and .git into agent image - disinto-admin/disinto

dev-bot commented

2026-04-07 18:41:27 +00:00

Collaborator

Problem

The Dockerfile uses COPY . which bakes .env (secrets), .git (huge), and other junk into the image. A stale .env inside the image can be sourced by env.sh, overwriting runtime env vars.

Fix

Create .dockerignore:

.env
.env.enc
.env.vault
.env.vault.enc
.git
*.tar.gz
prometheus-data/
docker-compose.yml
projects/*.toml

Affected files

.dockerignore (new file)

Acceptance criteria

docker build does not include .env or .git
Image size is smaller
No secrets in the image layer

Regression checklist

Do NOT exclude docker/agents/bin/ — Dockerfile COPY directives reference sops and tea binaries from there
Do NOT exclude state/ — check_active guard needs state/.dev-active etc. in the image
Do NOT exclude .env.enc or .sops.yaml — env.sh SOPS decryption path needs these
Do NOT exclude .env.example or formulas/ or lib/ or any script directories
Verify docker/agents/bin/sops and docker/agents/bin/tea COPY still works after .dockerignore
Note: projects/*.toml are gitignored and won't be in build context regardless — they need volume mount or runtime creation

Regression checklist

Do NOT exclude docker/agents/bin/ — Dockerfile COPY directives reference sops and tea binaries from there
Do NOT exclude state/ — check_active guard needs state/.dev-active etc. in the image
Do NOT exclude .env.enc or .sops.yaml — env.sh SOPS decryption path needs these
Do NOT exclude .env.example or formulas/ or lib/ or any script directories
Verify docker/agents/bin/sops and docker/agents/bin/tea COPY still works after .dockerignore
Note: projects/*.toml are gitignored and won’t be in build context regardless — they need volume mount or runtime creation

## Problem The Dockerfile uses COPY . which bakes .env (secrets), .git (huge), and other junk into the image. A stale .env inside the image can be sourced by env.sh, overwriting runtime env vars. ## Fix Create .dockerignore: .env .env.enc .env.vault .env.vault.enc .git *.tar.gz prometheus-data/ docker-compose.yml projects/*.toml ## Affected files - .dockerignore (new file) ## Acceptance criteria - [ ] docker build does not include .env or .git - [ ] Image size is smaller - [ ] No secrets in the image layer ## Regression checklist - [ ] Do NOT exclude docker/agents/bin/ — Dockerfile COPY directives reference sops and tea binaries from there - [ ] Do NOT exclude state/ — check_active guard needs state/.dev-active etc. in the image - [ ] Do NOT exclude .env.enc or .sops.yaml — env.sh SOPS decryption path needs these - [ ] Do NOT exclude .env.example or formulas/ or lib/ or any script directories - [ ] Verify docker/agents/bin/sops and docker/agents/bin/tea COPY still works after .dockerignore - [ ] Note: projects/*.toml are gitignored and won't be in build context regardless — they need volume mount or runtime creation ## Regression checklist - [ ] Do NOT exclude docker/agents/bin/ — Dockerfile COPY directives reference sops and tea binaries from there - [ ] Do NOT exclude state/ — check_active guard needs state/.dev-active etc. in the image - [ ] Do NOT exclude .env.enc or .sops.yaml — env.sh SOPS decryption path needs these - [ ] Do NOT exclude .env.example or formulas/ or lib/ or any script directories - [ ] Verify docker/agents/bin/sops and docker/agents/bin/tea COPY still works after .dockerignore - [ ] Note: projects/*.toml are gitignored and won’t be in build context regardless — they need volume mount or runtime creation