---
title: "Send only the files the build needs · Agent Wranglers"
url: https://agentwranglers.se/playbook/operations/containers/dockerignore
updated: 2026-10-20
licence: "All rights reserved"
---

# Send only the files the build needs

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Containers](https://agentwranglers.se/playbook/operations/containers)
- Rule: Keep a `.dockerignore` that leaves out dependencies, build output, version control, local data and every secret file.
- How: The build sends the whole folder to the builder unless you exclude files. Without the list, a local `.env` or a stray key can land in an image layer. List `node_modules`, `dist`, `.git`, data folders, `.env*` and key files.
- Check: Build with a test file named `.env.leak-test` in the folder. Then `docker run --rm --entrypoint sh shop -c 'find / -name ".env*" -not -path "/proc/*"'` prints nothing.

Example:

```text
**/node_modules
**/dist
.git
**/data
**/.env*
**/*.pem
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers operations playbook: https://agentwranglers.se/playbook/operations/containers/dockerignore`.

- Previous: [Never give a container control of the host](https://agentwranglers.se/playbook/operations/containers/no-privileged-containers)
- Next: [Pass build secrets as mounts instead of layers](https://agentwranglers.se/playbook/operations/containers/build-secrets)
- [Containers](https://agentwranglers.se/playbook/operations/containers)