From 840b7ea184c94cd6ebe014be43bcbbba7b971f90 Mon Sep 17 00:00:00 2001
From: Yury Semikhatsky <yurys@chromium.org>
Date: Tue, 3 Nov 2026 08:45:05 -0800
Subject: [PATCH 1/3] devops(docker): exclude .git from the Docker build
 context

---
 .dockerignore | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.dockerignore b/.dockerignore
index f609d7b5c..b8b8c5d00 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -1,5 +1,7 @@
 # The repository root is the Docker build context (see utils/docker/build.sh).
-# Keep registry credentials written by the release pipeline out of the images.
+# Keep VCS metadata and registry credentials written by the release pipeline
+# out of the images.
+.git
 **/.npmrc
 # Downloaded by publish_docker.sh after the first push.
 utils/docker/oras

From b5291bb1c17e3bbb3ed95af9b932498743f460ab Mon Sep 17 00:00:00 2001
From: Yury Semikhatsky <yurys@chromium.org>
Date: Tue, 3 Nov 2026 08:49:54 -0800
Subject: [PATCH 2/3] devops(docker): also exclude nested .git, credentials,
 env files and CI config

---
 .dockerignore | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/.dockerignore b/.dockerignore
index b8b8c5d00..1f2a116e4 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -1,7 +1,14 @@
-# The repository root is the Docker build context (see utils/docker/build.sh).
-# Keep VCS metadata and registry credentials written by the release pipeline
-# out of the images.
-.git
+# The repository root is the Docker build context (see utils/docker/build.sh),
+# and the image build copies all of it. Keep VCS metadata, registry credentials,
+# local environment files, and CI and editor configuration out of the build
+# context.
+**/.git
 **/.npmrc
+**/.netrc
+**/.env*
+.github
+.azure-pipelines
+.devcontainer
+.claude
 # Downloaded by publish_docker.sh after the first push.
 utils/docker/oras

From f404142d6d2968e5327029ad0a986608c3c1fec8 Mon Sep 17 00:00:00 2001
From: Yury Semikhatsky <yurys@chromium.org>
Date: Tue, 3 Nov 2026 08:52:14 -0800
Subject: [PATCH 3/3] devops(docker): keep CI config and .netrc in the build
 context

---
 .dockerignore | 10 ++--------
 1 file changed, 2 insertions(+), 8 deletions(-)

diff --git a/.dockerignore b/.dockerignore
index 1f2a116e4..7dc6ab376 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -1,14 +1,8 @@
 # The repository root is the Docker build context (see utils/docker/build.sh),
-# and the image build copies all of it. Keep VCS metadata, registry credentials,
-# local environment files, and CI and editor configuration out of the build
-# context.
+# and the image build copies all of it. Keep VCS metadata, registry credentials
+# and local environment files out of the build context.
 **/.git
 **/.npmrc
-**/.netrc
 **/.env*
-.github
-.azure-pipelines
-.devcontainer
-.claude
 # Downloaded by publish_docker.sh after the first push.
 utils/docker/oras