From a3ca08f3f620f70673154c2cfe8eab38523dd5e3 Mon Sep 17 00:00:00 2001
From: xfy <i@rua.plus>
Date: Wed, 15 Jul 2026 15:18:13 +0800
Subject: [PATCH] =?UTF-8?q?chore(docker):=20=E5=AE=8C=E5=96=84=20.dockerig?=
 =?UTF-8?q?nore=20=E8=A7=84=E5=88=99?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

原 .dockerignore 仅覆盖 target/.git/node_modules 与部分 public 产物,
遗漏多个会导致上下文膨胀或信息泄露的路径:

- 修复信息泄露: .env(含真实 DATABASE_URL)此前会进入构建上下文
- 新增未忽略的构建产物: public/xterm/、public/doc/
- 排除机器本地/无关目录: others/(55M 引用博客)、.freebsd-sysroot/、
  docker/(runner 镜像源,单独构建)、docs/、tests/、scripts/
- 排除 agent/IDE/CI 工具: .zcode/、.superpowers/、.agents/、.gitea/、
  .vscode/、.idea/、rust-analyzer.toml 等
- 补充常见本地文件: .DS_Store、*.swp、profile.json.gz、compose*.yaml

保留所有真实构建输入(Cargo.toml、build.rs、Dioxus.toml、input.css、
.cargo/config.toml、src/、migrations/、libs/ 工作区、themes/、syntaxes/
及 public 运行时资源 favicon.ico/icons/images/),已逐一核对。
---
 .dockerignore | 65 +++++++++++++++++++++++++++++++++++++++++++++++----
 1 file changed, 60 insertions(+), 5 deletions(-)

diff --git a/.dockerignore b/.dockerignore
index 6e91350..e14c400 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -1,25 +1,80 @@
+# ---------------------------------------------------------------------------
+# Local environment & secrets — must never enter the build context.
+# .env holds the real DATABASE_URL (with password); .env.example is just a
+# template but is not a build input either.
+# ---------------------------------------------------------------------------
+.env
+.env.*
+
+# ---------------------------------------------------------------------------
+# Build outputs & dependency caches — regenerated inside the container.
+# ---------------------------------------------------------------------------
 target/
-.git/
 dist/
 .dioxus/
+static/
 node_modules/
 libs/node_modules/
 libs/*/node_modules/
 
-# Generated assets are rebuilt inside the container.
+# Generated assets under public/ are rebuilt by the Dockerfile
+# (build-libs → highlight-css → tailwindcss → dx build). Keep the source
+# runtime assets (favicon.ico, icons/, images/) but drop generated ones.
 public/style.css
 public/highlight.css
 public/tiptap/
 public/codemirror/
 public/lightbox/
 public/yggdrasil-core/
+public/xterm/
+public/doc/
 
-# Uploads directory is created at runtime; only keep the gitkeep marker.
+# ---------------------------------------------------------------------------
+# Runtime data — created at startup, not part of the image build.
+# ---------------------------------------------------------------------------
 uploads/*
 !uploads/.gitkeep
-backups/*
-!backups/.gitkeep
+backups/
 
+# ---------------------------------------------------------------------------
+# Machine-local / unrelated directories — not build inputs.
+#   others/            — vendored reference blog (DansBlog)
+#   .freebsd-sysroot/  — FreeBSD cross-compile sysroot (local-only)
+#   docker/            — runner image sources, built separately
+#   docs/ tests/ scripts/ — docs & standalone scripts, not compiled in
+# ---------------------------------------------------------------------------
+others/
+.freebsd-sysroot/
+docker/
+docs/
+tests/
+scripts/
+
+# ---------------------------------------------------------------------------
+# Agent / IDE / CI tooling — never needed by the build.
+# ---------------------------------------------------------------------------
+.zcode/
+.superpowers/
+.agents/
+.gitea/
+.claude/
+.vscode/
+.idea/
+*.swp
+.DS_Store
+rust-analyzer.toml
+
+# ---------------------------------------------------------------------------
 # Docker files themselves are not needed in the build context.
+# ---------------------------------------------------------------------------
 Dockerfile
 .dockerignore
+compose*.yaml
+compose*.yml
+
+# ---------------------------------------------------------------------------
+# Misc local artifacts.
+# ---------------------------------------------------------------------------
+.git/
+.worktrees/
+profile.json.gz