Your .gitignore doesn't control what ends up in your Docker image. Meet contextleak: a tool that verifies .dockerignore actually works and catches secrets before they ship to the registry.
https://dev.to/haoli/your-gitignore-wont-save-your-docker-image-245i
