| 1 |
# Build context excludes. |
| 2 |
# |
| 3 |
# podman tars this directory into every build before reading the first |
| 4 |
# instruction, so anything large that no COPY reads is pure wait. output/ |
| 5 |
# alone is a multi-gigabyte ISO, which the build was shipping to itself on |
| 6 |
# every run. |
| 7 |
# |
| 8 |
# Keep this in step with the COPY lines in the Containerfiles: the image |
| 9 |
# build reads Cargo.toml, Cargo.lock, crates/, templates/, etc/, usr/ and |
| 10 |
# schemas/, and build/Containerfile.iso additionally reads build/make-iso.sh. |
| 11 |
# etc/ is read twice, once into the runtime image and once into the rust-build |
| 12 |
# stage, where etc/skel is checked against the rendered skeleton for overlap. |
| 13 |
# |
| 14 |
# "Keep this in step" is not advice that was followed. `/schemas` sat in the |
| 15 |
# exclusions below from 2026-07-19, and on 2026-08-01 the Containerfile grew |
| 16 |
# `COPY schemas /usr/share/alloy/schemas` to fix the settings tab opening on |
| 17 |
# "no schemas found". The two cancelled: the COPY matched nothing and podman |
| 18 |
# failed the build outright, so from that commit until 2026-08-03 the image |
| 19 |
# could not be built at all, by either profile. Nothing caught it because no |
| 20 |
# image was built in that window. crates/alloy/tests/build_context.rs is what |
| 21 |
# catches it now. |
| 22 |
|
| 23 |
# Cargo artifacts. The rust-build stage compiles from scratch inside the |
| 24 |
# image on purpose — host artifacts are built against a different libc and |
| 25 |
# must not reach it. |
| 26 |
/target |
| 27 |
|
| 28 |
# bootc-image-builder output: the ISO, raw and qcow2 images, manifests. |
| 29 |
# |
| 30 |
# output.prev is the rotated copy build-iso.sh and build-image.sh leave behind |
| 31 |
# so a failed run cannot take the last good artifact with it. It was added to |
| 32 |
# a different file and never mirrored here, which quietly put a second |
| 33 |
# multi-gigabyte ISO back into every build context. That is the exact cost |
| 34 |
# the header above says this file exists to prevent. Both are currently 6.9G. |
| 35 |
/output |
| 36 |
/output.prev |
| 37 |
/dist |
| 38 |
|
| 39 |
# The install-source cache build/build-iso.sh keeps between runs: an OCI layout |
| 40 |
# of the image itself, so ~3G that no COPY reads and that would otherwise be |
| 41 |
# tarred into the build that produced it. |
| 42 |
/.iso-cache |
| 43 |
|
| 44 |
# Not read by any COPY. |
| 45 |
/.git |
| 46 |
# Excluded except the few files a COPY reads: the script |
| 47 |
# build/Containerfile.iso copies in, the two RPM specs the rust-build stage |
| 48 |
# packages the console and the terminal with, and the seeded font bases. The |
| 49 |
# negations have to follow the exclusion; reversed, they do nothing. |
| 50 |
# |
| 51 |
# base-cache/ normally holds one README, so it costs the context nothing. What |
| 52 |
# it costs when it is seeded is the four base files, ~180 KB, which is the price |
| 53 |
# of a build that does not depend on somebody else's rate limiter answering. |
| 54 |
# |
| 55 |
# It is negated twice on purpose. Every other negation in this file names one |
| 56 |
# file, and that shape is proven by the builds that ship; this is the first |
| 57 |
# directory, and whether a matcher re-includes a directory's CONTENTS from a |
| 58 |
# directory negation alone was not measured here, since settling it means |
| 59 |
# running a build. So the second line negates the files, which is the shape |
| 60 |
# already known to work. Delete either one only with a build to show for it. |
| 61 |
/build |
| 62 |
!/build/make-iso.sh |
| 63 |
!/build/rpm/alloy.spec |
| 64 |
!/build/rpm/shop.spec |
| 65 |
!/build/base-cache |
| 66 |
!/build/base-cache/** |
| 67 |
/builds.disabled |
| 68 |
/docs |
| 69 |
/tools |
| 70 |
|