clawbot
30f6471666
Check / check (pull_request) Skipped
Docker does not apply .dockerignore to a build context sent as a tar, so upaas sent every file in the clone. The build now reads the ignore file as docker build does, <Dockerfile>.dockerignore next to the Dockerfile if there is one, otherwise .dockerignore at the root, with the ignorefile reader of moby/patternmatcher, and passes its patterns as exclude patterns. As the docker command line does, the Dockerfile and .dockerignore are never left out. The ignore file is read through os.Root, so it cannot be read from outside the clone. An ignore file that cannot be read, or a malformed pattern, fails the build. Model: opus-5-5
95 lines
2.7 KiB
Go
95 lines
2.7 KiB
Go
package docker
|
|
|
|
import (
|
|
"errors"
|
|
"fmt"
|
|
"io"
|
|
"io/fs"
|
|
"os"
|
|
"path/filepath"
|
|
|
|
"github.com/docker/docker/pkg/archive"
|
|
"github.com/moby/patternmatcher"
|
|
"github.com/moby/patternmatcher/ignorefile"
|
|
)
|
|
|
|
// defaultDockerfileName is the Dockerfile Docker builds when none is named.
|
|
const defaultDockerfileName = "Dockerfile"
|
|
|
|
// defaultDockerignoreName is the ignore file at the root of a build context,
|
|
// read when the Dockerfile has no ignore file of its own.
|
|
const defaultDockerignoreName = ".dockerignore"
|
|
|
|
// tarBuildContext returns a tar of the build context in contextDir that leaves
|
|
// out the files the app's ignore file names, as docker build does; Docker does
|
|
// not apply the ignore file to a build context sent as a tar. dockerfile is
|
|
// the path of the Dockerfile inside contextDir.
|
|
func tarBuildContext(contextDir, dockerfile string) (io.ReadCloser, error) {
|
|
excludes, err := readDockerignore(contextDir, dockerfile)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
return archive.TarWithOptions(contextDir, &archive.TarOptions{
|
|
ExcludePatterns: excludes,
|
|
})
|
|
}
|
|
|
|
// readDockerignore returns the patterns of the files to leave out of the
|
|
// build context in contextDir, read as docker build reads them for the
|
|
// Dockerfile at dockerfile: from <dockerfile>.dockerignore next to the
|
|
// Dockerfile if there is one, otherwise from .dockerignore at the root of the
|
|
// context. Without either file there are no patterns.
|
|
func readDockerignore(contextDir, dockerfile string) ([]string, error) {
|
|
if dockerfile == "" {
|
|
dockerfile = defaultDockerfileName
|
|
}
|
|
|
|
// Reading through os.Root keeps the read inside the build context, even
|
|
// when the ignore file is a symlink.
|
|
root, err := os.OpenRoot(contextDir)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
defer func() { _ = root.Close() }()
|
|
|
|
name := dockerfile + defaultDockerignoreName
|
|
|
|
file, err := root.Open(name)
|
|
if errors.Is(err, fs.ErrNotExist) {
|
|
name = defaultDockerignoreName
|
|
file, err = root.Open(name)
|
|
}
|
|
|
|
if errors.Is(err, fs.ErrNotExist) {
|
|
return nil, nil
|
|
}
|
|
|
|
if err != nil {
|
|
return nil, fmt.Errorf("failed to read %s: %w", name, err)
|
|
}
|
|
|
|
defer func() { _ = file.Close() }()
|
|
|
|
excludes, err := ignorefile.ReadAll(file)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("failed to read %s: %w", name, err)
|
|
}
|
|
|
|
// Like the docker command line, never leave out .dockerignore or the
|
|
// Dockerfile: Docker reads the Dockerfile from the context.
|
|
for _, keep := range []string{defaultDockerignoreName, filepath.ToSlash(dockerfile)} {
|
|
excluded, err := patternmatcher.MatchesOrParentMatches(keep, excludes)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("invalid pattern in %s: %w", name, err)
|
|
}
|
|
|
|
if excluded {
|
|
excludes = append(excludes, "!"+keep)
|
|
}
|
|
}
|
|
|
|
return excludes, nil
|
|
}
|