build(docker): exclude local runtime state from build context#3246
build(docker): exclude local runtime state from build context#3246BXL1015 wants to merge 1 commit into
Conversation
There was a problem hiding this comment.
Pull request overview
Note
Copilot was unable to run its full agentic suite in this review.
Updates the Docker build context exclusions to prevent project configuration files and related directories from being sent to the Docker daemon during builds.
Changes:
- Added config file patterns (YAML/JSON and backups) to
.dockerignore - Added
.deer-flow/directories (root and backend) to.dockerignore
| config.yaml | ||
| config.yml | ||
| configure.yml | ||
| mcp_config.json | ||
| extensions_config.json | ||
| config.yaml.bak | ||
| backend/config.yaml | ||
| backend/config.yml | ||
| backend/configure.yml | ||
| backend/mcp_config.json | ||
| backend/extensions_config.json | ||
| backend/config.yaml.bak | ||
| .deer-flow/ | ||
| backend/.deer-flow/ |
There was a problem hiding this comment.
Keeping the root/backend entries explicit is intentional: those are the supported local config locations today. A broader ** pattern would also exclude unrelated fixture or nested config files.
| extensions_config.json | ||
| config.yaml.bak | ||
| backend/config.yaml | ||
| backend/config.yml | ||
| backend/configure.yml | ||
| backend/mcp_config.json | ||
| backend/extensions_config.json |
There was a problem hiding this comment.
These files are runtime/local configs rather than Docker build inputs. The checked-in templates remain included, and Compose mounts runtime configs; the sentinel build also verified normal backend files still enter the context.
|
|
Summary
backend/config paths..deer-flow/andbackend/.deer-flow/)..gitignore.The documented Docker setup has contributors create
config.yamlbefore Docker image builds. Without matching.dockerignoreentries, these local config/runtime files can still be sent in the Docker build context. In particular,backend/.deer-flow/can be copied into backend image layers byCOPY backend ./backend.This is a build hygiene hardening change, not a security vulnerability report.
Test plan
git diff --check -- .dockerignore