Dockerignore Generation

DevOps & Security

dockerignore-generation

Dockerignore Generation is an Agent Skill for devops & security published in the nixopus/nixopus repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.

Generate ecosystem-specific .dockerignore files to reduce build context size and prevent secret leaks. Use when no .dockerignore exists, when the build context is large, or when secrets may be leaking into images.

View on GitHub ↗

QUICK START

How to use this skill

Bring this guide into your coding agent with a prompt tailored to the tool you use.

Open your project in Codex.
Copy and paste the prompt below.
Review files and risks before approving any action.

Prompt to paste

Inspect the Agent Skill at https://github.com/nixopus/nixopus/blob/HEAD/api/skills/dockerignore-generation/SKILL.md and all supporting files. Report provenance, permissions, scripts, dependencies, and security risks. Propose an exact installation into .agents/skills/dockerignore-generation, but wait for my approval before writing files or running scripts.

Copying this prompt does not install or run the skill. Review third-party files before use.

.dockerignore Generation

Why It Matters

Without a .dockerignore:

Build context includes node_modules (hundreds of MB), .git history, and local env files
Secrets in .env files get copied into the image and are extractable
Build is slow because Docker sends the entire directory to the daemon

Base Template (all ecosystems)

Every .dockerignore should include:

.git
.gitignore
.env
.env.*
!.env.example
!.env.sample
*.md
!README.md
LICENSE
docker-compose*.yml
.dockerignore
Dockerfile
.vscode
.idea
.cursor

Ecosystem-Specific Entries

Node.js

node_modules
.next
.nuxt
.output
dist
build
.cache
coverage
.nyc_output
*.log
npm-debug.log*
yarn-debug.log*
yarn-error.log*
.pnpm-debug.log*
.turbo
.vercel
.netlify
storybook-static

Python

__pycache__
*.pyc
*.pyo
*.egg-info
.eggs
.venv
venv
env
.tox
.pytest_cache
.mypy_cache
.ruff_cache
htmlcov
*.cover

Go

vendor/
*.test
*.out
bin/
tmp/

Rust

target/
*.rs.bk

Java

target/
build/
.gradle/
*.class
*.jar
!*.jar  # if copying JARs intentionally, remove this line
.settings/
.classpath
.project

Ruby

vendor/bundle
.bundle
log/
tmp/
coverage/
spec/reports

PHP

vendor/
storage/logs/
storage/framework/cache/
storage/framework/sessions/
storage/framework/views/
bootstrap/cache/

Elixir

_build/
deps/
.elixir_ls/
cover/

.NET

bin/
obj/
*.user
*.suo
packages/

Generation Logic

Start with the base template
Detect ecosystem from the project (check for package.json, go.mod, requirements.txt, etc.)
Append the matching ecosystem entries
If test/ or tests/ or __tests__/ exists: add test directories
If .github/ exists: add .github/
Write to .dockerignore at the project root

Gotchas

!.env.example negates the .env.* exclusion — keep example env files so Dockerfile can reference them
Monorepos: .dockerignore is relative to the build context root, not the Dockerfile location
Docker Compose build.context changes what .dockerignore applies to — if context is ., the root .dockerignore applies
Don't ignore prisma/ if Prisma is used — prisma/schema.prisma is needed for postinstall
Don't ignore lockfiles (package-lock.json, yarn.lock, etc.) — they're essential for reproducible builds

Related Skills

pre-deploy-checklist — Checks for .dockerignore existence and flags missing ones
dockerfile-generation — Generate .dockerignore alongside the Dockerfile