Audit .dockerignore to minimize Docker build context

[josecelano]

Goal

Ensure the Docker build context sent to BuildKit is as small as possible by auditing .dockerignore against .gitignore and the actual container contents, then adding any paths that are tracked by git but not needed in any Containerfile stage.

Background

Every file not excluded from the build context is transferred to the BuildKit daemon before the build starts. Large contexts increase transfer time, create unnecessary cache invalidation when unrelated files change (e.g. docs, CI config, dev tools), and add noise to layer diffs.

The baseline analysis (#1841) already identified one concrete case: the .tmp/ directory (AI agent hook logs + benchmark cargo isolation dirs) was included in the build context and triggering cache misses. That entry was added to .dockerignore as a quick fix. A systematic audit may reveal further candidates.

Additionally, the Containerfile stages that perform a full source copy (COPY . /build/src) are particularly sensitive to context size: any file not excluded will invalidate those layers' cache whenever it changes, even if the change is irrelevant to the build (e.g. updating a doc or a YAML config file).

Known Candidates

Path	Reason likely safe to exclude
.github/	CI config — not referenced by any stage
.vscode/	Editor config — not referenced by any stage
docs/	Documentation — not referenced by any stage
codecov.yaml	CI config — not referenced by any stage
compose.*.yaml	Compose files — not referenced by any stage
cspell.json / project-words.txt	Spell-check config — not used inside container
rustfmt.toml	Formatter config — not used inside container
AGENTS.md / README.md / NOTICE / SECURITY.md / LICENSE	Project docs — not used inside container
contrib/dev-tools/	Dev tooling — not used inside container

These are candidates only. Each must be confirmed safe before being added.

Acceptance Criteria

• AC1: Current Docker build context size is measured and recorded.
• AC2: All tracked repo paths are classified as needed / excluded / intentionally kept with a rationale.
• AC3: .dockerignore is updated with all confirmed-safe exclusions.
• AC4: No Containerfile stage is broken by the new exclusions (all CI checks pass).
• AC5: Build context size is re-measured and the reduction is documented.
• AC6: Intentionally included paths are documented with inline comments in .dockerignore.

Related

• Parent EPIC: EPIC: Improve PR Workflow Performance #1840
• Baseline analysis: Baseline workflow profiling and bottleneck analysis (EPIC #1840) #1841
• Full spec: docs/issues/open/ (after spec PR merge)