dockerfile.dockerignore not working

[mmerickel]

Actual behavior
#801 presumably added the ability to use kaniko with a dockerignore file following the format ${DOCKERFILE}.dockerignore where $DOCKERFILE is the path specified in the --dockerfile arg to the executor. However, in my tests it's not being picked up and used.

Expected behavior
Match what docker build does when DOCKER_BUILDKIT=1 and what #801 claims to do.

I expect if I run the executor with --dockerfile foo then foo.dockerignore will be used as the ignore file applied to the build context if it is found.

To Reproduce
Steps to reproduce the behavior:

1. Setup a simple environment with a file that we want to fail to copy into the container.

$ mkdir -p foo
$ touch foo/bar
$ echo "FROM ubuntu\nCOPY foo foo\nRUN ls foo" > Dockerfile
$ echo '*' > Dockerfile.dockerignore

2. Build an image.

$ docker run --rm -it -v $(pwd):/build gcr.io/kaniko-project/executor --context /build --dockerfile /build/Dockerfile --no-push
INFO[0000] Retrieving image manifest ubuntu
INFO[0000] Retrieving image ubuntu
INFO[0000] Retrieving image manifest ubuntu
INFO[0000] Retrieving image ubuntu
INFO[0002] Built cross stage deps: map[]
INFO[0002] Retrieving image manifest ubuntu
INFO[0002] Retrieving image ubuntu
INFO[0002] Retrieving image manifest ubuntu
INFO[0002] Retrieving image ubuntu
INFO[0003] Executing 0 build triggers
INFO[0003] Unpacking rootfs as cmd COPY foo foo requires it.
INFO[0008] COPY foo foo
INFO[0008] Taking snapshot of files...
INFO[0008] RUN ls foo
INFO[0008] Taking snapshot of full filesystem...
INFO[0008] cmd: /bin/sh
INFO[0008] args: [-c ls foo]
INFO[0008] Running: [/bin/sh -c ls foo]
bar
INFO[0008] Taking snapshot of full filesystem...
INFO[0008] No files were changed, appending empty layer to config. No layer added to image.
INFO[0008] Skipping push to container registry due to --no-push flag

3. Note that it worked and copied the file instead of ignoring it. unexpected
4. Move the file to just .dockerignore at the root of the build context and run it again.

$ mv Dockerfile.dockerignore .dockerignore$ docker run --rm -it -v $(pwd):/build gcr.io/kaniko-project/executor --context /build --dockerfile /build/Dockerfile --no-push
INFO[0000] Using dockerignore file: /build/.dockerignore
INFO[0000] Retrieving image manifest ubuntu
INFO[0000] Retrieving image ubuntu
INFO[0001] Retrieving image manifest ubuntu
INFO[0001] Retrieving image ubuntu
INFO[0002] Built cross stage deps: map[]
INFO[0002] Retrieving image manifest ubuntu
INFO[0002] Retrieving image ubuntu
INFO[0003] Retrieving image manifest ubuntu
INFO[0003] Retrieving image ubuntu
INFO[0004] Executing 0 build triggers
INFO[0004] Unpacking rootfs as cmd COPY foo foo requires it.
INFO[0008] COPY foo foo
INFO[0008] Taking snapshot of full filesystem...
INFO[0010] RUN ls foo
INFO[0010] Taking snapshot of full filesystem...
INFO[0010] cmd: /bin/sh
INFO[0010] args: [-c ls foo]
INFO[0010] Running: [/bin/sh -c ls foo]
ls: cannot access 'foo': No such file or directory
error building image: error building stage: failed to execute command: waiting for process to exit: exit status 2

5. Note that it failed to copy the file, as expected, and that an INFO log message noted at the top that it was using the dockerignore file.

Triage Notes for the Maintainers

Description	Yes/No
Please check if this a new feature you are proposing
Please check if the build works in docker but not in kaniko
Please check if this error is seen when you use --cache flag
Please check if your dockerfile is a multistage dockerfile

[mmerickel]

I've traced this to the fact that kaniko copies the Dockerfile into /kaniko/Dockerfile prior to execution.

kaniko/cmd/executor/cmd/root.go

Lines 207 to 251 in 6c70f16

	// resolveDockerfilePath resolves the Dockerfile path to an absolute path
	func resolveDockerfilePath() error {
	if isURL(opts.DockerfilePath) {
	return nil
	}
	if util.FilepathExists(opts.DockerfilePath) {
	abs, err := filepath.Abs(opts.DockerfilePath)
	if err != nil {
	return errors.Wrap(err, "getting absolute path for dockerfile")
	}
	opts.DockerfilePath = abs
	return copyDockerfile()
	}
	// Otherwise, check if the path relative to the build context exists
	if util.FilepathExists(filepath.Join(opts.SrcContext, opts.DockerfilePath)) {
	abs, err := filepath.Abs(filepath.Join(opts.SrcContext, opts.DockerfilePath))
	if err != nil {
	return errors.Wrap(err, "getting absolute path for src context/dockerfile path")
	}
	opts.DockerfilePath = abs
	return copyDockerfile()
	}
	return errors.New("please provide a valid path to a Dockerfile within the build context with --dockerfile")
	}
	// resolveEnvironmentBuildArgs replace build args without value by the same named environment variable
	func resolveEnvironmentBuildArgs(arguments []string, resolver func(string) string) {
	for index, argument := range arguments {
	i := strings.Index(argument, "=")
	if i < 0 {
	value := resolver(argument)
	arguments[index] = fmt.Sprintf("%s=%s", argument, value)
	}
	}
	}
	// copy Dockerfile to /kaniko/Dockerfile so that if it's specified in the .dockerignore
	// it won't be copied into the image
	func copyDockerfile() error {
	if _, err := util.CopyFile(opts.DockerfilePath, constants.DockerfilePath, "", util.DoNotChangeUID, util.DoNotChangeGID); err != nil {
	return errors.Wrap(err, "copying dockerfile")
	}
	opts.DockerfilePath = constants.DockerfilePath
	return nil
	}

From what I can tell #801 has never actually worked, because this file copy has been happening since before #801 started testing for the related $DOCKERFILE.dockerignore path.

[borramTAS]

Hi, I have the same problem:

--dockerfile=/main/src/docker/tomcat/base/base.Dockerfile

DEBU[0000] Copying file /main/src/docker/tomcat/base/base.Dockerfile to /kaniko/Dockerfile
DEBU[0000] Skip resolving path /kaniko/Dockerfile
DEBU[0000] Skip resolving path /main
DEBU[0000] Skip resolving path /cache
DEBU[0000] Skip resolving path
DEBU[0000] Skip resolving path
DEBU[0000] Skip resolving path
DEBU[0000] Built stage name to index map: map[]
INFO[0000] Retrieving image manifest tomcat:9.0.38-jdk11-adoptopenjdk-hotspot

The base.Dockerfile.dockerignore is completely ignored.

If I rename the file base.Dockerfile.dockerignore to .dockerignore, it works.