From 1067510de89e64a257eeb6db1cec297e197d2c02 Mon Sep 17 00:00:00 2001
From: Luis Cosio <luisalfonsocosioizcapa@gmail.com>
Date: Sun, 19 Jul 2026 19:21:32 -0700
Subject: [PATCH] =?UTF-8?q?=F0=9F=94=92=20fix:=20exclude=20.env=20from=20D?=
 =?UTF-8?q?ocker=20build=20context?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The builder stage runs COPY . . and Docker does not read .gitignore,
so a real .env (this repo ships .env.example) lands in builder-stage
layers in the local build cache. The final image is unaffected
(multi-stage, binary-only), but cache layers are exportable and
--target builder images would carry the secret. /certs was already
excluded; .env now is too.
---
 .dockerignore | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.dockerignore b/.dockerignore
index 7bf0e73..52696b9 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -6,3 +6,5 @@
 /logs.txt
 /*.log
 /*.jsonl
+/.env
+/.env.*