Module context 

A task’s build context: the files a Dockerfile may COPY, read from a directory the way docker build reads one (#221, IMAGE-7).

What enters the artifact

Every regular file under the directory that the ignore rules leave in, at its path relative to the root, /-separated. The rules are Dockerfile.dockerignore when that file exists and .dockerignore otherwise — the precedence Docker gives a Dockerfile-specific ignore file, and the artifact’s Dockerfile is always named Dockerfile. Four names at the root never enter from the context:

• Dockerfile, because the artifact carries the caller’s Dockerfile (usually wrap_dockerfile’s output) in its place;
• .dockerignore and Dockerfile.dockerignore, because the rules have already been applied, and an ignore file inside the artifact would let the platform’s own build exclude the agentd entry — * then !src is enough;
• agentd, which is refused rather than skipped: it would replace the daemon.

Links, and other things that are not files

A symlink is skipped with a warning naming it. Following it could copy files from outside the context the caller never put there, and the archive cannot carry the link itself. Sockets, FIFOs and devices are skipped the same way. The warnings travel back on BuildContext::warnings so a harness can log them.

Modes

0o755 for a file with any execute bit and 0o644 for the rest: COPY keeps the mode the archive entry carries, a script that loses its execute bit fails in the guest, and two hosts with different umasks must still produce one artifact. On a platform without Unix modes every file is 0o644.

The agent token has no way in

TRAP-5’s rule for the shared snapshot holds: nothing here takes a credential. The context is the caller’s files, exactly as docker build takes them; what the image keeps of them is what the caller’s Dockerfile copies.

Structs

BuildContext

A build context: the files beside the Dockerfile in the artifact, sorted by name.

ContextEntry

One file of a build context: its path relative to the context root, its mode, and its bytes.

IgnoreRules

The patterns of a .dockerignore file, applied the way Docker applies them.

Constants

DAEMON_ENTRY

The artifact’s daemon entry, which no context file may take.

DOCKERFILE_ENTRY

The artifact’s Dockerfile entry, which the caller’s Dockerfile fills.

IGNORE_FILES

The ignore files, in precedence order.

MAX_CONTEXT_BYTES

S3’s maximum object size for a single PutObject, 5 GiB, which is how the artifact is uploaded. A context bigger than that cannot be uploaded at all, so it is refused while it is read rather than after it is zipped in memory.

Functions

glob_match

Whether path matches the .dockerignore glob pattern, taken as written (already cleaned). A malformed pattern matches nothing.