Control the build context

The final dot in docker build ... . selects the build context. Dockerfile COPY instructions can only read files from that context.

Sending a large context slows builds and can accidentally make sensitive files available to COPY. A .dockerignore file excludes paths before the context is sent to the builder.

node_modules
.git
.env
coverage
dist
*.log

Think of the context as a security and correctness boundary, not only a performance setting. A file excluded by .dockerignore cannot be copied accidentally. A file that enters an image layer can remain recoverable from image history even if a later step deletes it, so never copy credentials and then try to clean them up.

When a build genuinely needs a credential, use a BuildKit secret mount so the secret is available only to that build step and is not committed to a layer. Run a plain-progress build and read the context transfer line:

docker build --progress=plain -t notes-api:dev .

If the context is unexpectedly large, inspect .dockerignore and the directory passed as the final build argument before optimizing individual instructions.

Create .dockerignore, add a temporary large file, and compare the build context size before and after ignoring it.