# .dockerignore uses Go filepath.Match, NOT .gitignore semantics: `*`
# does not cross `/`, and a pattern without a leading `**/` is anchored
# at the build-context root. Every depth-independent pattern therefore
# needs the `**/` prefix — without it `config/.env` and
# `certs/server.key` still ship while the file reads as solved. Entries
# that are genuinely root-anchored stay unprefixed. Extend this file
# with the repo's own host-built artifacts (compiled binaries, test
# binaries, coverage output); those are per-repo and belong here because
# a host build otherwise drops them into the context.

# Repository metadata: exactly one, at the context root.
.git

# Environment and secrets. These are the reason the prefixes matter: a
# developer's local copy is invisible to every git-based check.
**/.env
**/.env.*
**/*.pem
**/*.key

# Dependencies: restored inside the image, never copied in.
**/node_modules

# OS metadata.
**/.DS_Store
**/Thumbs.db

# Editor state. Never a build input, and it churns under a developer's
# hands, so it invalidates COPY for reasons unrelated to the source.
**/*.swp
**/*.swo
**/*~
**/*.bak
**/.idea
**/.vscode
**/*.sublime-*