fix: fix: add .dockerignore — stop baking .env and .git into agent image (#377) #385

Merged

dev-qwen merged 1 commit from fix/issue-377 into main

2026-04-07 19:29:06 +00:00

dev-qwen commented

2026-04-07 19:22:03 +00:00

Collaborator

Fixes #377

Changes

Fixes #377 ## Changes

dev-qwen added 1 commit 2026-04-07 19:22:04 +00:00

fix: fix: add .dockerignore — stop baking .env and .git into agent image (#377 )

ci/woodpecker/push/ci Pipeline was successful

Details

ci/woodpecker/pr/ci Pipeline was successful

Details

cbc2a0ca4e

review-bot commented

2026-04-07 19:28:27 +00:00

Collaborator

AI Review

Summary

Adds a .dockerignore to prevent sensitive and unnecessary files from entering the Docker build context for the agent image. The Dockerfile uses COPY . /home/agent/disinto (line 24), so without this file everything in the repo root — including any local .env — was being baked in.

Review

The exclusions are all correct and well-motivated:

.env / .env.* — primary fix: prevents plaintext secrets from landing in the image. The entrypoint injects secrets via env vars at runtime, so these files are not needed inside the image.
.git — correct; large and unused at runtime.
*.tar.gz, prometheus-data/ — correct; ephemeral/large data not needed at build time.
docker-compose.yml — correct; only used by the host orchestrator.
projects/*.toml — correct; gitignored locally anyway, won't be present in a CI build context.

Notes

The secrets/ directory (gitignored, SOPS-encrypted) is not excluded, but since its contents are encrypted and it won't exist in a clean CI build context, this is not a blocking concern.
No external action patterns, no vault violations, no structural issues.

Verdict

APPROVE — Correct, well-scoped .dockerignore that prevents .env and other sensitive/bulky files from being baked into the agent image.

Reviewed at cbc2a0c | AGENTS.md

## AI Review  ### Summary Adds a `.dockerignore` to prevent sensitive and unnecessary files from entering the Docker build context for the agent image. The Dockerfile uses `COPY . /home/agent/disinto` (line 24), so without this file everything in the repo root — including any local `.env` — was being baked in. ### Review The exclusions are all correct and well-motivated: - **`.env` / `.env.*`** — primary fix: prevents plaintext secrets from landing in the image. The entrypoint injects secrets via env vars at runtime, so these files are not needed inside the image. - **`.git`** — correct; large and unused at runtime. - **`*.tar.gz`**, **`prometheus-data/`** — correct; ephemeral/large data not needed at build time. - **`docker-compose.yml`** — correct; only used by the host orchestrator. - **`projects/*.toml`** — correct; gitignored locally anyway, won't be present in a CI build context. ### Notes - The `secrets/` directory (gitignored, SOPS-encrypted) is not excluded, but since its contents are encrypted and it won't exist in a clean CI build context, this is not a blocking concern. - No external action patterns, no vault violations, no structural issues. ### Verdict **APPROVE** — Correct, well-scoped .dockerignore that prevents .env and other sensitive/bulky files from being baked into the agent image. --- *Reviewed at `cbc2a0c` | [AGENTS.md](AGENTS.md)*

review-bot approved these changes 2026-04-07 19:28:27 +00:00

review-bot left a comment

Collaborator

AI Review: APPROVE — Correct, well-scoped .dockerignore that prevents .env and other sensitive/bulky files from being baked into the agent image.

AI Review: **APPROVE** — Correct, well-scoped .dockerignore that prevents .env and other sensitive/bulky files from being baked into the agent image.