Building devcontainers does not use .dockerignore file next to the Dockerfile.

[GarbenTangheVintecc]

Hi, is it possible that the .dockerignore file next to the Dockerfile is not being used to ignore files in the build context?

I used to think only the .dockerignore file in the root of the Docker build context was used and I know that it is not possible to specify another .dockerignore file using command line arguments (e.g. -i path/to/.dockerignore).
Then I read about this file naming workaround: Filename and location.

This works fine when I use docker compose build, docker buildx build, and docker buildx bake.
However, opening in a container, this Dockerfile.dockerignore next to my Dockerfile is not being used, while the one in the root of my context is working.

[GarbenTangheVintecc]

The file structure of our repo is as follows:

• .devcontainer/
  • app/
    • devcontainer.json

      {
        "dockerComposeFile": "docker-compose.yaml",
        "service": "app",
        "workspaceFolder": "/workspace"
      }

    • docker-compose.yaml

      services:
        app:
          image: app
          build:
            context: ../..
            dockerfile: .devcontainer/app/Dockerfile
          stdin_open: true # docker run -i
          tty: true        # docker run -t
          volumes:
            - ../..:/workspace

    • Dockerfile

      FROM ubuntu:24.04
      COPY . /tmp/build_context
      # COPY ./app/requirements.txt /requirements.txt
      ENTRYPOINT [ "/usr/bin/bash" ]

    • Dockerfile.dockerignore

      # Ignore everything except the requirements of the app
      *
      !/app/requirements.txt  

• app/
  • requirements.txt
  • ...
• .dockerignore

  # Ignore everything
  *

When running docker compose build && docker compose run app, the /tmp/build_context folder only contains app/requirements.txt as expected. This means that the .devcontainer/app/Dockerfile.dockerignore got precedence over the .dockerignore in the root.
When trying to open this with "Open in container", the folder is empty.

When I try to COPY the app/requirements file (which is supposed to be in the Docker build context) I get this error:

------
 > [dev_container_auto_added_stage_label 4/4] COPY ./app/requirements.txt /requirements.txt:
------
failed to solve: failed to compute cache key: failed to calculate checksum of ref 0291ed9b-3c32-4257-8fac-f5bb2cae17c3::ectvq1xdo5dk52zr1ijkwgw6t: "/app/requirements.txt": not found

When adding the !/app/requirements.txt entry to the .dockerignore file in the root folder, the file is included in the build context. This shows that you only look for the .dockerignore file in the root folder.

[chrmarti]

The CLI generates a custom Dockerfile at a temp location. We could check if a Dockerfile.dockerignore file exists next to the Dockerfile and copy that over.

[GarbenTangheVintecc]

That would be great!

Please take into account that the Dockerfile could for example be named dev.Dockerfile and in this case, the dockerignore file would then be named dev.Dockerfile.dockerignore.
So to generalize, take the name of the Dockerfile, and append the .dockerignore suffix.

[GarbenTangheVintecc]

@chrmarti, do you have any updates on this topic?

[polotek]

Isn't this kind of a big deal? I'm not sure how much this has been discussed elsewhere. I was also surprised that .dockerignore was not respected. It resulted in my .env file being pulled into the build with sensitive variables in it. The build was local, so it wasn't a huge deal. But it could've been.

I'm new to dev containers. It sounds like the primary use case is pulling down fresh git repos which shouldn't have any secrets in them. That's fine. But if it's possible for people to build in other ways, they need to know how to ensure their secrets won't propagate to places they didn't intend.