Docker Is Weird – What That Means for AI‑Heavy DevOps Workflows

说明与用途

Docker 更新的忽略机制实现了更精确的构建上下文控制，降低镜像大小并提升 AI 工作负载的安全性。

问题

Docker’s new ignore logic now drops files matching both .dockerignore and .gitignore, exposing hidden dependencies and risking accidental inclusion of large source files in AI workloads.

结果

Implementing explicit .dockerignore and CI checks reduced image size, cut pull times by ~30 % on GKE, and prevented accidental credential leaks.

工作流

• Audit ignore files with a build context test to list files sent to the daemon
• Create a dedicated .dockerignore listing everything that should never be in an image
• Keep .gitignore for source‑control only and rely on Docker to drop duplicates
• Verify image size locally using BuildKit and inspect layer history
• Automate the context audit in CI to fail builds that ship unintended files

证据

Docker now ignores files that match both .dockerignore and .gitignore when you run docker build

来源

Many teams rely on a single .gitignore and assume Docker will respect it – that’s no longer safe

来源

The payoff is immediate: our model‑serving pods now pull 30 % faster on GKE

来源