From 057e0bd9a92b36fc5804a49288dd743be37ff5ec Mon Sep 17 00:00:00 2001
From: clawbot <35+clawbot@noreply.example.org>
Date: Tue, 29 Sep 2026 07:42:20 +0200
Subject: [PATCH] Add a .dockerignore (closes #39)

Adds a .dockerignore, which REPO_POLICIES.md lists among the files every repo has. Until now every docker build sent the whole working tree as its build context, and the image's source archive is made from that context. It now keeps out .git, local build and test output, archives, local databases, .env and a local Go workspace. Every tracked file stays in, so the format check, the linter, the tests, the build and the source archive read the same files as before.

Without .git in the context the binary's build info records no git revision; nothing in routewatch reads it.

Model: opus-5-5
---
 .dockerignore | 28 ++++++++++++++++++++++++++++
 TODO.md       |  8 ++++----
 2 files changed, 32 insertions(+), 4 deletions(-)
 create mode 100644 .dockerignore

diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..063d4cc
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,28 @@
+# Docker does not read .gitignore, and a pattern here matches from the root of
+# the build context only: a pattern meant for every directory needs `**/`.
+
+.git
+
+# Local build and debug output: `make build`, `make run`, `make asupdate`, test
+# binaries, coverage profiles and source archives.
+/bin
+/log.txt
+/out
+/pkg/asinfo/asdata.json
+**/*.tar.zst
+**/*.test
+**/*.out
+**/*.tmp
+
+# Local databases and secrets. The image carries a source archive of the whole
+# build context, so these would otherwise ship inside it.
+**/*.db
+**/*.db-journal
+**/*.db-wal
+**/.env
+
+# A local Go workspace points at directories outside the build context.
+/go.work
+/go.work.sum
+
+**/.DS_Store
diff --git a/TODO.md b/TODO.md
index fbab888..03fd25f 100644
--- a/TODO.md
+++ b/TODO.md
@@ -24,12 +24,13 @@ https://git.eeqj.de/sneak/routewatch/pulls/6. After that, setting
 routewatch up under upaas on fsn1app1 and deploying it are his
 (https://git.eeqj.de/sneak/routewatch/issues/31), and so is the run under a
 real 5 GiB limit (https://git.eeqj.de/sneak/routewatch/issues/3).
-Nothing on the record orders
-https://git.eeqj.de/sneak/routewatch/issues/39 and
-https://git.eeqj.de/sneak/routewatch/issues/30.
+The other open issue is https://git.eeqj.de/sneak/routewatch/issues/30.
 
 # Completed Steps
 
+- 2026-09-29: `.dockerignore` keeps `.git`, local build output, local
+  databases and `.env` out of the Docker build context, and so out of the
+  source archive in the image (closes #39)
 - 2026-09-29: README first line names the MIT license and the author;
   the License section now says MIT and links `LICENSE`, and an Author
   section was added; this file brought up to date (closes #38)
@@ -102,4 +103,3 @@ https://git.eeqj.de/sneak/routewatch/issues/30.
 - `/api/v1/stats` answered HTTP 500 after 35 hours on the live feed, seen
   on `3898daa`, which predates the 2026-09-22 in-memory statistics
   (https://git.eeqj.de/sneak/routewatch/issues/30)
-- Add a `.dockerignore` (https://git.eeqj.de/sneak/routewatch/issues/39)