moby: Exception patterns in .dockerignore do not support wildcard directories

This is a pain in the ***.

Worst thing is; there’s no workaround for this. I’ve been manually adding each directory to it. I have a /dir/Dockerfile which composer uses with ./ context and every time I create a new folder and I forget to add it to the .dockerignore, it gets in the image until someone notices it.

Why is it so hard to make this file to behave just like .gitignore ?

try: ! **/*.txt

The only thing I wish to COPY is Makefile and *.go files.

*
!Makefile
!**/*.go
!vendor/modules.txt
!go.mod
!go.sum

(well, go.mod as well) This doesn’t seem to be possible right now 😦

I may have a workaround for you:

**/*.*
!**/*.go
!vendor/modules.txt
!go.mod
!go.sum

This will copy all directories and files without extensions. The exclusions work if the directories are not ignored. So you only have to add files without extensions (like Dockerfile) to the ignore list.

Any updates on this issue?

This is a frustration every single time I want to make a Docker build for my projects using a whitelist-style dockerignore. Maybe I’ve just been using Docker wrong from the start, but I don’t understand how dockerignore files, a tremendously simple, yet fundamental feature of Docker, can just be left broken and neglected for literally years.

Are whitelist-style dockerignore files simply an unsupported use-case?

Also, this seems like it might be the same as this issue: https://github.com/moby/moby/issues/23693

The special ** wildcard doesn’t work, either. I believe this is because of the logic changed by #20872. Specifically, it only prevents a filepath.SkipDir if the file contains exceptions and the exclusion pattern (sans !, plus / at the end) contains the prefix relFilePath + string(filepath.Separator).

So with that, here’s how the bug happens in pkg/archive.TarWithOptions based on my example in the description:

• It filepath.Walks to the recipes directory
• recipes gets excluded by the * rule
  • and none of the exceptions add the recipes directory back explicitly
• There are exceptions, continue
• Construct dirSlash
  • dirSlash := relFilePath + string(filepath.Separator)
  • dirSlash = recipes/ in this example
• Process pat
  • pat = pat[1:] + string(filepath.Separator)
  • pat is converted from !*/*.txt to */*.txt/
• Check the prefix match
  • Does pat contain the prefix dirSlash?
  • a.k.a. does */*.txt/ contain recipes/
  • No, it does not; the bug appears to lie in the reliance upon prefix matching, then

Note that if the pat had been !recipes/*.txt, the processed pat would have been recipes/*.txt/, which would have had the prefix dirSlash (recipes/).

This is the heart of the bug. Directories can’t be used as wildcards for exception rules because of this prefix matching business.

Any Updates?

This issue still exists… Any update on this?

.dockerignore

*
!**/*.txt

Dockerfile

FROM alpine

RUN apk update && apk add tree
ADD . /stuff

CMD tree stuff

tree output

.
├── dir1
│   ├── dir2
│   │   └── file2.txt
│   ├── file1.py
│   └── file1.txt
└── Dockerfile

docker run $(docker build --no-cache -q .) output

stuff

0 directories, 0 files

I would also love to use such a feature 👍 . Use case is the same as @arvenil 's, i.e., it would be much easier to keep track of what I’m sending to the build context using an allow list rather than a deny list.

The only thing I wish to COPY is Makefile and *.go files.

*
!Makefile
!**/*.go
!vendor/modules.txt
!go.mod
!go.sum

(well, go.mod as well) This doesn’t seem to be possible right now 😦

Why is it so hard to make this file to behave just like .gitignore ?

A wild guess: original thinking was to include whatever functionality go provided natively.

Perhaps it’s time to reconsider, docker build is used together with git a lot, it would be awesome if same format was supported! One may even hope for .gitignore to be picked up automatically fi it exists, though that could break dirty builds (git checkout, build artefacts in-place, docker build)… I’d welcome this though!