Keep secrets out of your image.

Keep COPY . . from including .env, .git history or SSH keys in an image. Generate a stack-specific .dockerignore to exclude secrets and unnecessary files.

The secret you didn’t mean to ship

It happens constantly: a Dockerfile with COPY . ., a .env full of real credentials sitting in the project root, and now that file is a permanent part of an image layer — readable by anyone who can pull it, even after you “delete” it in a later RUN step, because layers keep history. Scanners and researchers find exactly these leaks in public images all the time. A .dockerignore closes the door before it can happen, and it costs you one file.

It’s a small instance of a constant: secrets end up in places you didn’t intend, and the only real defense is keeping them out by default and being able to prove where they are. Managing secrets and build artifacts cleanly across the backend you own is part of what a control plane keeps honest.