Repository navigation
chore: keep secrets out of the Docker build context; drop stale README step - #153
Merged
Merged
Conversation
…E step The build stage of the Dockerfile runs `COPY . .`, so anything left in the checkout root is sent to the builder and copied into the build stage. Exclude the local secrets and backups that the install and backup scripts create there: .env, config.json, jwt.key and backups/. keys/ was already excluded. The Docker Compose (manual) section of the README still told users to build the single binary before `docker compose up -d --build`. Since the multi-stage Dockerfile builds the frontend and the Go binary itself, that step is no longer needed; remove it.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed
.dockerignore: exclude.env,config.json,jwt.keyandbackupsfrom the build context.keyswas already listed, so it is not duplicated. Entries follow the file's existing style (root-relative names, no trailing slash).README.md, "Option 2: Docker Compose (manual)": remove the line that told users to build the single binary (frontend, thengo build -tags embedui) beforedocker compose up -d --build.Why
Since #147 the Dockerfile is a multi-stage build: a Node stage builds the frontend, a Go stage builds the binary through
build.sh, and the runtime stage copies the result. Its build stage runsCOPY . ., so every file in the checkout root that is not ignored goes to the builder.install.shwrites.env(Postgres password, API key) and, for the local option,config.json; the local binary writesjwt.key;scripts/backup.shwrites database dumps tobackups/by default. None of these are needed to build the image, and none should end up in the build context or a build cache.The README step was left over from before #147:
docker compose up -d --buildnow builds the frontend and the binary itself (compose buildsartexfromcontext: .), so the manual pre-build is unnecessary and misleading. The surrounding instructions already describe the Docker path and are unchanged.How it was checked
.env,config.json,jwt.keyorbackups/;.envis consumed by compose for variable substitution, not by the image build, and.env.exampleis not affected by the.envpattern.git ls-filesshows none of the newly ignored paths are tracked.docker build .on this branch (from WSL) completed successfully. The live stack was not started.