[Bug]: .dockerignore is not respected during container build

[samurai00]

I have done the following

• I have searched the existing issues
• If possible, I've reproduced the issue using the 'main' branch of this project

Steps to reproduce

1. Create a project directory, for example, a Rust project which generates a large target directory.
2. Create a .dockerignore file in the root of the project with the following content to exclude the build artifacts and IDE folders:

   target
   .idea
   .vscode
   

3. Have a directory structure similar to this, where target is large (e.g., >400MB):

   $ dua
      4.10 KB .dockerignore
      4.10 KB .gitignore
      4.10 KB Cargo.toml
      4.10 KB Dockerfile
      ...
    409.96 MB target
    411.48 MB total

4. Create a Dockerfile that uses a COPY . . instruction to copy the project source:

   # Dockerfile
   FROM rust:alpine as builder
   WORKDIR /opt/src/my-project
   # This step is expected to exclude files from .dockerignore
   COPY . .
   RUN cargo build --release
   ...

5. Run the build command:

   container build --tag my-app --file Dockerfile .

Current behavior

The build process includes files and directories that should be ignored, resulting in an unnecessarily large build context.

In one instance, the build log shows a context size of over 400MB, even though the source code is less than 1MB and the target directory is in .dockerignore:

[internal] load build context                                                                                                3.8s
=> => transferring context: 405.05MB                                                                                            3.8s

The problem is more severe with very large ignored directories. For example, with a target directory of ~6.8 GB, the build fails immediately during the context creation phase, before any Dockerfile instructions are executed.

Project structure:

$ dua
   ...
  41.68 MB .git
   6.81 GB target
   6.85 GB total

Build command and error:

$ container build --tag zexus-axum-lite --file Dockerfile-axum-lite .
[+] Building 7.1s (2/3)
 => [resolver] fetching image...docker.io/library/rust:slim                                                                      0.0s
 => [resolver] fetching image...docker.io/library/debian:bookworm-slim                                                           0.0s
Error: failed to create entry

The error failed to create entry suggests that the tool cannot handle the massive build context, a problem that the .dockerignore file is specifically designed to prevent.

Expected behavior

The container build command should respect the .dockerignore file. The target directory and any other specified patterns should be excluded from the build context sent to the builder.

The build context size should be small, reflecting only the necessary source files. For example, after applying a workaround, the context size is correctly reduced:

[internal] load build context                                                                                                0.2s
=> => transferring context: 94.59kB                                                                                             0.2s

The build should proceed using only the files not excluded by .dockerignore.

Workaround

The issue can be circumvented by avoiding COPY . . and instead explicitly copying only the required files and directories in the Dockerfile:

-COPY . .
+COPY Cargo.lock Cargo.toml /opt/src/race-dns-proxy/
+COPY src /opt/src/race-dns-proxy/src

With this change, the build succeeds and the build context is appropriately small. This strongly suggests the issue lies with .dockerignore handling.

Environment

- OS: macOS 15.6
- Xcode: Version 16.4 (16F6)
- Container: container CLI version 0.3.0 (build: release, commit: 3fcf647)

Relevant log output

Code of Conduct

• I agree to follow this project's Code of Conduct

[katiewasnothere]

Hi @samurai00 thanks for the report! This does appear to be a bug.

The way the builder works today, we launch a container that has buildkit and our custom shim running in it for container to issue commands to. container will talk to the shim over grpc.

There's two interesting things going on here. The first is that it looks like the container side buildfssync doesn't support taking in the patterns from .dockerignore.

The second thing is that even if the .dockerignore file is included in the context sent to the buildkit container, the files are not being excluded from the image when the image is built with buildkit. I tested this by writing a simple CLI test that had a .dockerignore file in the context. The full context was sent over to the buildkit container (refer to the first issue above for the cause) including files matching a pattern in .dockerignore. But additionally, I see in the logs that buildkit does load the .dockerignore file. Despite this, the resulting image still has files in it that should have been ignored due to the .dockerignore. I would have expected buildkit to still filter out the files.

The first issue I described is probably all that needs to be fixed to resolve the issue users are facing here. The second is just something interesting that I'm curious about.

[jglogan]

Closed by #1154