A .dockerignore file controls which files and directories Docker excludes while copying a project into an image. Use it to keep secrets and unrelated metadata out of shareable image artifacts. section 12.2.4
Exclude secrets and project metadata
Create .dockerignore beside the Dockerfile. A practical starting point excludes the .streamlit/ directory, where secrets.toml may live, along with Python caches and Git metadata. section 12.2.4
Listing 12.3 The .dockerignore file
__pycache__/ .git/ .gitignore .streamlit/
The example lists patterns for excluding __pycache__/, .git/, .gitignore, and .streamlit/ during an image build. section 12.2.4
Extend the file when deployment creates additional sensitive configuration:
- Add .ebextensions/ so deployment configuration containing secrets is not copied into the image. section 12.3.5
- Add .elasticbeanstalk/ before initializing Elastic Beanstalk, because the directory will be generated later. section 12.3.5



