🔒 Exclude .env from Docker build context - #10
Open
luiscosio wants to merge 1 commit into
Open
Conversation
The builder stage runs COPY . . and Docker does not read .gitignore, so a real .env (this repo ships .env.example) lands in builder-stage layers in the local build cache. The final image is unaffected (multi-stage, binary-only), but cache layers are exportable and --target builder images would carry the secret. /certs was already excluded; .env now is too.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
One-line defense-in-depth fix, independent of #9.
Dockerfileline 4 runsCOPY . .in the builder stage, and Docker does not read.gitignore. This repo ships.env.example, so real.envfiles exist on dev machines; building with one present bakes it into builder-stage layers in the local build cache. The published image is unaffected (multi-stage: final stage copies only the compiled binary), but cache layers are exportable (--target builder, cache pushes), so the context should never contain it..dockerignorealready excluded/certs— this adds/.envand/.env.*alongside it.Verification:
.dockerignoresemantics only — the entry follows the existing file's root-anchored pattern style. CI builds from a clean checkout and never had a.env, so no remote image is affected.