Leave out of the build context what the app's .dockerignore names (closes #274)
Docker does not apply .dockerignore to a build context sent as a tar, so upaas sent every file in the clone. The build now reads the ignore file as docker build does, <Dockerfile>.dockerignore next to the Dockerfile if there is one, otherwise .dockerignore at the root, with the ignorefile reader of moby/patternmatcher, and passes its patterns as exclude patterns. As the docker command line does, the Dockerfile and .dockerignore are never left out. An ignore file that cannot be read, or a malformed pattern, fails the build. Model: opus-5-5
This commit is contained in:
@@ -659,8 +659,16 @@ func (c *Client) performBuild(
|
||||
)
|
||||
}
|
||||
|
||||
// Create tar archive of build context
|
||||
tarArchive, err := archive.TarWithOptions(opts.ContextDir, &archive.TarOptions{})
|
||||
// Docker does not apply the app's .dockerignore to a build context sent
|
||||
// as a tar, so leave out the files it names here, as docker build does.
|
||||
excludes, err := readDockerignore(opts.ContextDir, opts.DockerfilePath)
|
||||
if err != nil {
|
||||
return "", fmt.Errorf("failed to create build context: %w", err)
|
||||
}
|
||||
|
||||
tarArchive, err := archive.TarWithOptions(opts.ContextDir, &archive.TarOptions{
|
||||
ExcludePatterns: excludes,
|
||||
})
|
||||
if err != nil {
|
||||
return "", fmt.Errorf("failed to create build context: %w", err)
|
||||
}
|
||||
|
||||
@@ -0,0 +1,62 @@
|
||||
package docker
|
||||
|
||||
import (
|
||||
"errors"
|
||||
"fmt"
|
||||
"io/fs"
|
||||
"os"
|
||||
"path/filepath"
|
||||
|
||||
"github.com/moby/patternmatcher"
|
||||
"github.com/moby/patternmatcher/ignorefile"
|
||||
)
|
||||
|
||||
// readDockerignore returns the patterns of the files to leave out of the
|
||||
// build context in contextDir, read as docker build reads them for the
|
||||
// Dockerfile at dockerfile, a path inside contextDir: from
|
||||
// <dockerfile>.dockerignore next to the Dockerfile if there is one, otherwise
|
||||
// from .dockerignore at the root of the context. Without either file there
|
||||
// are no patterns.
|
||||
func readDockerignore(contextDir, dockerfile string) ([]string, error) {
|
||||
if dockerfile == "" {
|
||||
dockerfile = "Dockerfile" // what Docker builds when none is named
|
||||
}
|
||||
|
||||
name := dockerfile + ".dockerignore"
|
||||
|
||||
file, err := os.Open(filepath.Join(contextDir, name))
|
||||
if errors.Is(err, fs.ErrNotExist) {
|
||||
name = ".dockerignore"
|
||||
file, err = os.Open(filepath.Join(contextDir, name))
|
||||
}
|
||||
|
||||
if errors.Is(err, fs.ErrNotExist) {
|
||||
return nil, nil
|
||||
}
|
||||
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("failed to read %s: %w", name, err)
|
||||
}
|
||||
|
||||
defer func() { _ = file.Close() }()
|
||||
|
||||
excludes, err := ignorefile.ReadAll(file)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("failed to read %s: %w", name, err)
|
||||
}
|
||||
|
||||
// Like the docker command line, never leave out .dockerignore or the
|
||||
// Dockerfile: Docker reads the Dockerfile from the context.
|
||||
for _, keep := range []string{".dockerignore", filepath.ToSlash(dockerfile)} {
|
||||
excluded, err := patternmatcher.MatchesOrParentMatches(keep, excludes)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("invalid pattern in %s: %w", name, err)
|
||||
}
|
||||
|
||||
if excluded {
|
||||
excludes = append(excludes, "!"+keep)
|
||||
}
|
||||
}
|
||||
|
||||
return excludes, nil
|
||||
}
|
||||
@@ -0,0 +1,224 @@
|
||||
package docker //nolint:testpackage // tests the unexported performBuild
|
||||
|
||||
import (
|
||||
"archive/tar"
|
||||
"errors"
|
||||
"io"
|
||||
"log/slog"
|
||||
"net/http"
|
||||
"net/http/httptest"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"slices"
|
||||
"strings"
|
||||
"testing"
|
||||
|
||||
"github.com/docker/docker/client"
|
||||
)
|
||||
|
||||
// TestPerformBuildFollowsDockerignore runs builds against a fake Docker API
|
||||
// and checks which files the build context sent to it holds.
|
||||
func TestPerformBuildFollowsDockerignore(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
tests := []struct {
|
||||
name string
|
||||
dockerfile string
|
||||
files map[string]string // path in the context: contents
|
||||
want []string // files sent in the build context
|
||||
}{
|
||||
{
|
||||
name: "no ignore file",
|
||||
dockerfile: "Dockerfile",
|
||||
files: map[string]string{"Dockerfile": "", "main.go": ""},
|
||||
want: []string{"Dockerfile", "main.go"},
|
||||
},
|
||||
{
|
||||
name: "excludes and re-includes",
|
||||
dockerfile: "Dockerfile",
|
||||
files: map[string]string{
|
||||
".dockerignore": "secret.txt\n*.md\n!README.md\n",
|
||||
"Dockerfile": "",
|
||||
"NOTES.md": "",
|
||||
"README.md": "",
|
||||
"main.go": "",
|
||||
"secret.txt": "",
|
||||
},
|
||||
want: []string{".dockerignore", "Dockerfile", "README.md", "main.go"},
|
||||
},
|
||||
{
|
||||
name: "keeps the Dockerfile and .dockerignore",
|
||||
dockerfile: "Dockerfile",
|
||||
files: map[string]string{
|
||||
".dockerignore": "Dockerfile\n.dockerignore\nsecret.txt\n",
|
||||
"Dockerfile": "",
|
||||
"main.go": "",
|
||||
"secret.txt": "",
|
||||
},
|
||||
want: []string{".dockerignore", "Dockerfile", "main.go"},
|
||||
},
|
||||
{
|
||||
name: "an ignore file next to the Dockerfile wins over .dockerignore",
|
||||
dockerfile: "deploy/Dockerfile",
|
||||
files: map[string]string{
|
||||
".dockerignore": "main.go\n",
|
||||
"deploy/Dockerfile": "",
|
||||
"deploy/Dockerfile.dockerignore": "secret.txt\n",
|
||||
"main.go": "",
|
||||
"secret.txt": "",
|
||||
},
|
||||
want: []string{
|
||||
".dockerignore",
|
||||
"deploy/Dockerfile",
|
||||
"deploy/Dockerfile.dockerignore",
|
||||
"main.go",
|
||||
},
|
||||
},
|
||||
}
|
||||
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
contextDir := t.TempDir()
|
||||
|
||||
for name, contents := range tt.files {
|
||||
path := filepath.Join(contextDir, name)
|
||||
|
||||
err := os.MkdirAll(filepath.Dir(path), 0o750)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
|
||||
err = os.WriteFile(path, []byte(contents), 0o600)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
}
|
||||
|
||||
got, err := buildContextFiles(t, contextDir, tt.dockerfile)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
|
||||
if !slices.Equal(got, tt.want) {
|
||||
t.Errorf("build context holds %q, want %q", got, tt.want)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
// TestPerformBuildFailsOnMalformedDockerignore checks that a pattern the
|
||||
// docker command line would reject fails the build.
|
||||
func TestPerformBuildFailsOnMalformedDockerignore(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
contextDir := t.TempDir()
|
||||
|
||||
err := os.WriteFile(filepath.Join(contextDir, ".dockerignore"), []byte("[\n"), 0o600)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
|
||||
_, err = buildContextFiles(t, contextDir, "Dockerfile")
|
||||
|
||||
want := "failed to create build context: " +
|
||||
"invalid pattern in .dockerignore: syntax error in pattern"
|
||||
if err == nil || err.Error() != want {
|
||||
t.Errorf("got error %v, want %q", err, want)
|
||||
}
|
||||
}
|
||||
|
||||
// TestPerformBuildFailsOnUnreadableDockerignore checks that an ignore file
|
||||
// that cannot be read, here because it is a directory, fails the build.
|
||||
func TestPerformBuildFailsOnUnreadableDockerignore(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
contextDir := t.TempDir()
|
||||
|
||||
err := os.Mkdir(filepath.Join(contextDir, ".dockerignore"), 0o750)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
|
||||
_, err = buildContextFiles(t, contextDir, "Dockerfile")
|
||||
|
||||
want := "failed to create build context: failed to read .dockerignore: "
|
||||
if err == nil || !strings.HasPrefix(err.Error(), want) {
|
||||
t.Errorf("got error %v, want one starting %q", err, want)
|
||||
}
|
||||
}
|
||||
|
||||
// buildContextFiles runs a build of contextDir against a fake Docker API and
|
||||
// returns the names of the files in the build context sent to it, sorted.
|
||||
func buildContextFiles(t *testing.T, contextDir, dockerfile string) ([]string, error) {
|
||||
t.Helper()
|
||||
|
||||
sent := make(chan []string, 1)
|
||||
|
||||
srv := httptest.NewServer(http.HandlerFunc(
|
||||
func(w http.ResponseWriter, r *http.Request) {
|
||||
switch {
|
||||
case strings.HasSuffix(r.URL.Path, "/version"):
|
||||
_, _ = w.Write([]byte(`{"Version":"27.3.1","ApiVersion":"1.47"}`))
|
||||
case strings.HasSuffix(r.URL.Path, "/session"):
|
||||
serveSession(t, w, r, make(chan string, 1))
|
||||
case strings.HasSuffix(r.URL.Path, "/build"):
|
||||
sent <- tarFileNames(t, r.Body)
|
||||
default:
|
||||
t.Errorf("unexpected request to %s", r.URL.Path)
|
||||
}
|
||||
},
|
||||
))
|
||||
t.Cleanup(srv.Close)
|
||||
|
||||
dockerAPI, err := client.NewClientWithOpts(
|
||||
client.WithHost("tcp://" + srv.Listener.Addr().String()),
|
||||
)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
|
||||
c := &Client{docker: dockerAPI, log: slog.Default()}
|
||||
|
||||
_, err = c.performBuild(t.Context(), BuildImageOptions{
|
||||
ContextDir: contextDir,
|
||||
DockerfilePath: dockerfile,
|
||||
})
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
return <-sent, nil
|
||||
}
|
||||
|
||||
// tarFileNames returns the names of the regular files in the tar read from r,
|
||||
// sorted.
|
||||
func tarFileNames(t *testing.T, r io.Reader) []string {
|
||||
t.Helper()
|
||||
|
||||
var names []string
|
||||
|
||||
reader := tar.NewReader(r)
|
||||
|
||||
for {
|
||||
header, err := reader.Next()
|
||||
if errors.Is(err, io.EOF) {
|
||||
break
|
||||
}
|
||||
|
||||
if err != nil {
|
||||
t.Errorf("reading the build context: %v", err)
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
if header.Typeflag == tar.TypeReg {
|
||||
names = append(names, header.Name)
|
||||
}
|
||||
}
|
||||
|
||||
slices.Sort(names)
|
||||
|
||||
return names
|
||||
}
|
||||
Reference in New Issue
Block a user