Local config files that can hold the signing key still reach the Docker build context #211

New Issue

2026-10-04T23:41:48+02:00

clawbot commented

2026-10-04 23:41:48 +02:00

Found by the work on #210 (#205). Checked against next at cca2e3f.

.gitignore keeps local config files out of git (for example config.yaml and config.dev.yml), because they can hold the signing key. .dockerignore does not exclude them, so a local config left in a working tree reaches the Docker build context and, through COPY . ., a build-stage layer of an image built from that tree.

Plan: every local config file name .gitignore excludes for that reason is excluded in .dockerignore too, at any depth (**/), with a one-line comment saying why; configs/config.example.yml (the public example) stays in. Check it as #205 did: plant such files at the root and two directories deep, build a COPY . . image, list it, remove everything.

Model: opus-5-5

Found by the work on https://git.eeqj.de/sneak/pixa/pulls/210 (https://git.eeqj.de/sneak/pixa/issues/205). Checked against `next` at `cca2e3f`. `.gitignore` keeps local config files out of git (for example `config.yaml` and `config.dev.yml`), because they can hold the signing key. `.dockerignore` does not exclude them, so a local config left in a working tree reaches the Docker build context and, through `COPY . .`, a build-stage layer of an image built from that tree. Plan: every local config file name `.gitignore` excludes for that reason is excluded in `.dockerignore` too, at any depth (`**/`), with a one-line comment saying why; `configs/config.example.yml` (the public example) stays in. Check it as https://git.eeqj.de/sneak/pixa/issues/205 did: plant such files at the root and two directories deep, build a `COPY . .` image, list it, remove everything. Model: opus-5-5

clawbot referenced this issue

2026-10-05 00:09:59 +02:00

`config.yml`, the config file Getting Started creates, is kept out of neither git nor the Docker build context #212

clawbot referenced this issue from a commit

2026-10-05 00:10:16 +02:00

Keep local config files out of the Docker build context (closes #211)

clawbot referenced a pull request that will close this issue

2026-10-05 00:18:45 +02:00

Keep local config files out of the Docker build context (closes #211) #214

clawbot commented

2026-10-05 00:18:52 +02:00

Built in #214: .dockerignore now leaves out config.yaml and config.dev.yml in every directory. config.yml, which Getting Started creates, is in neither .gitignore nor .dockerignore; that is filed as #212.

Model: opus-5-5

Built in https://git.eeqj.de/sneak/pixa/pulls/214: `.dockerignore` now leaves out `config.yaml` and `config.dev.yml` in every directory. `config.yml`, which Getting Started creates, is in neither `.gitignore` nor `.dockerignore`; that is filed as https://git.eeqj.de/sneak/pixa/issues/212. Model: opus-5-5

clawbot referenced this issue

2026-10-05 00:33:23 +02:00

Keep local config files out of the Docker build context (closes #211) #214

clawbot referenced this issue from a commit

2026-10-05 00:49:38 +02:00

Keep local config files out of the Docker build context (closes #211)

clawbot referenced this issue from a commit

2026-10-05 01:13:16 +02:00

Keep local config files out of the Docker build context (closes #211)

clawbot closed this issue

2026-10-05 01:24:42 +02:00

clawbot referenced this issue from a commit