The Docker build context carries client files and live secrets #224

New Issue

Closed

opened 2026-09-10 04:13:34 -05:00 by null · 1 comment

null commented

2026-09-10 04:13:34 -05:00

Owner

Seen at a25077d (v0.9.5).

What is true now. .dockerignore does not exclude .drop/, zoho.md (the live reCAPTCHA secret key and the Zoho WebToLead tokens), Levi.md, or the two 30 MB zips, so all of it is sent into the Docker build context and the builder stage. The final image copies only built output (Dockerfile:79-81), so nothing has shipped. One careless COPY would change that.

What to do. Add .drop/, zoho.md, Levi.md and *.zip to .dockerignore. It also shrinks every build context by about 60 MB.

Verify: a throwaway build of the context (FROM busybox, COPY . /ctx, RUN find /ctx -maxdepth 2) run against this .dockerignore lists none of those paths, and npm run docker:build still succeeds.

Seen at a25077d (v0.9.5). **What is true now.** `.dockerignore` does not exclude `.drop/`, `zoho.md` (the live reCAPTCHA secret key and the Zoho WebToLead tokens), `Levi.md`, or the two 30 MB zips, so all of it is sent into the Docker build context and the builder stage. The final image copies only built output (`Dockerfile:79-81`), so nothing has shipped. One careless `COPY` would change that. **What to do.** Add `.drop/`, `zoho.md`, `Levi.md` and `*.zip` to `.dockerignore`. It also shrinks every build context by about 60 MB. Verify: a throwaway build of the context (`FROM busybox`, `COPY . /ctx`, `RUN find /ctx -maxdepth 2`) run against this `.dockerignore` lists none of those paths, and `npm run docker:build` still succeeds.

null added this to the Batch 18: Guards and landmines found building Batch 17 milestone 2026-09-10 04:13:34 -05:00

null added the

security

infra

labels 2026-09-10 04:13:34 -05:00

null referenced this issue from a commit

2026-09-10 04:58:41 -05:00

fix(seo): the production sitemap had no dates, and the build context had secrets

null commented

2026-09-10 04:58:57 -05:00

Author

Owner

Done in 2f1e248. .dockerignore now excludes .drop/, zoho.md (the live reCAPTCHA secret and Zoho tokens), Levi.md, *.zip, *.eml, *.pdf and the four agent workspaces. Proven by listing the build context from inside a throwaway busybox image built against this .dockerignore: before the change the context carried .drop, zoho.md, Levi.md and two 30 MB zips; after it, ls reports 'No such file or directory' for each, and the context is down to the source, docs, scripts and public assets.

Done in 2f1e248. .dockerignore now excludes .drop/, zoho.md (the live reCAPTCHA secret and Zoho tokens), Levi.md, *.zip, *.eml, *.pdf and the four agent workspaces. Proven by listing the build context from inside a throwaway busybox image built against this .dockerignore: before the change the context carried .drop, zoho.md, Levi.md and two 30 MB zips; after it, ls reports 'No such file or directory' for each, and the context is down to the source, docs, scripts and public assets.

null closed this issue

2026-09-10 04:58:58 -05:00