38

Let's focus on a scenario where both Docker and Git are used in a project. In this case it's convenient to maintain both .gitignore and .dockerignore files.

I'm trying to understand the relation between the two files. My beginner's suspicion is that .dockerignore should be a superset of .gitignore and always contain at least the same items.

My reasoning is that if the .dockerignore doesn't list some file that is .gitignored, then our build context on the developer's machine will include this file whereas a build context in the Continuous Integration environment won't (as it only works on files present in the git repository). This can easily lead to a situation where a docker image built locally works, but an image build from the same code on the build server is broken, because it works with a different input data.

Is this true that .dockerignore should typically be a superset of .gitignore? If so, do you actually use some tooling to enforce this relation?

3
  • 2
    They're different files that do different things. They have very little in common. For example you may not want to check in your package-lock.json in GIT but you may want it in Docker.
    – Liam
    Nov 5, 2019 at 8:38
  • 9
    @Liam No, both git and docker should check in package-lock.json.
    – Run
    Oct 12, 2020 at 10:25
  • 1
    The package-lock.json (and similar files in other ecosystems) file should be present while buiding the Docker image, but it doesn’t have to be there at runtime.
    – lxg
    Nov 8, 2020 at 8:09

3 Answers 3

13

It is fairly common to build an application outside of Docker and inject the resulting binary. The most common example I see on SO is with Java-based applications. The Java class file format is designed to be portable across environments and so there aren't a lot of differences if a .jar file is built on a developer's workstation or not. You can run

mvn build
docker build -t myapp .
FROM tomcat:9
COPY target/myapp.war /usr/local/tomcat/apps

In this setup the target directory would be in .gitignore (you do not want build artifacts committed to source control) but it would not be in .dockerignore (it needs to be available to the image).

Some other patterns where this could be useful include:

  • In a compiled language in a developer environment with somewhat long build times, so that you can get a test image out without spending several minutes waiting for make in a multi-stage build
  • When an image needs to contain static assets that are hosted somewhere outside of source control, like Amazon S3
  • If there are data sets that get generated at build time, that are large enough to not want to be checked in but small enough that adding them to the image is still practical (5-500 MB perhaps)

(I mostly ignore .dockerignore but I also try to be explicit about what files I COPY into my images.)

2
  • 3
    now I see the mistake in my original reasoning, I assumed that the whole build would typically happen inside of Docker. Thanks for a great counter-examples that show it greatly depends on the setup and doesn't have to be true! Nov 5, 2019 at 12:10
  • Just as a note, I disagree that you should be building locally and then copying into Docker. I don't find any of the arguments listed here compelling. (1) means you aren't utilizing docker caching properly. (2) you should be fetching as part of your docker image build. (3) also sounds like a failure at docker layer caching. Dec 4, 2023 at 9:58
8

I do not think .dockerignore must be a superset of .gitignore. Docker ignore contains files which you want Docker build to ignore and in some cases it could be your source code as well. Take the example of a Java project that you are building with maven.

In this case when you are building the docker container you are probably only interested in the target folder and not any other folder. Whereas the .gitignore will have the target folder since you wont be checking in the compiled binaries (jar / war) to the source repo.

Similarly there could be other files that are generated / downloaded during your build which are required in the container but not in the source repo. So in a nutshell I don't think it is a good idea to enforce the superset rule, at least not in a generic all encompassing way.

1
  • 1
    I like your counter-example as it shows that indeed I can't generalize this way. I assumed that we always do the whole build inside of container, and the build context is the same as the checked-in source code. I accepted David's answer because he was first, but yours answers the question well too :) Nov 5, 2019 at 12:30
0

If you are performing all your build steps in Docker e.g. using multi-stage Dockerfiles then I think it can make sense to not allow Docker to see any files that are not checked in.

I acheived this using symlinks e.g.

ln -s .gitignore .dockerignore

Then check in the .dockerignore symlink and the files will remain the same. Be cautious with this if also working on Windows

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.