Agent Wranglers

Containers Required

Send only the files the build needs

Keep a .dockerignore that leaves out dependencies, build output, version control, local data and every secret file.

By Erik Bergstedt, Agent Wranglers. Updated .

How to do it

The build sends the whole folder to the builder unless you exclude files. Without the list, a local .env or a stray key can land in an image layer. List node_modules, dist, .git, data folders, .env* and key files.

Example

**/node_modules
**/dist
.git
**/data
**/.env*
**/*.pem

How to check

Build with a test file named .env.leak-test in the folder. Then docker run --rm --entrypoint sh shop -c 'find / -name ".env*" -not -path "/proc/*"' prints nothing.

For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers operations playbook: https://agentwranglers.se/playbook/operations/containers/dockerignore.