.git .agents .claude .codex # `**/` matters: a .dockerignore pattern is matched against the WHOLE # context-relative path, so a bare `.env` excludes ONLY the root file and # `COPY . .` would bake docker/.env -- CODEMAN_PASSWORD and any provider API # keys -- into the published image at /opt/codeman/docker/.env (verified). **/.env **/.env.* !**/.env.example # Same shape: docker/docker-compose.override.yml is the documented home for # host-specific settings, so it must not ride COPY . . into the image either. **/docker-compose.override.* node_modules dist coverage out test-results tmp *.log