From 425e3db07ab844e83502b084954f98ff276e42dd Mon Sep 17 00:00:00 2001
From: j4n <j4n@systemli.org>
Date: Tue, 17 Feb 2026 08:05:57 +0100
Subject: [PATCH] docker: slim build by excluding .git and non-essential files

Replace the in-Dockerfile `git rev-parse HEAD` with a GIT_HASH build arg
passed from docker-compose (local) or github.sha (CI), defaulting to
"unknown" when unset.

Also exclude .github/, docs/, tests/, and *.md (except www/**/*.md).
---
 .dockerignore                       | 10 ++++++++++
 .github/workflows/docker-build.yaml |  2 ++
 docker-compose.yaml                 |  2 ++
 docker/chatmail_relay.dockerfile    |  8 ++++++--
 4 files changed, 20 insertions(+), 2 deletions(-)

diff --git a/.dockerignore b/.dockerignore
index 7ed1e6fe..37c3d866 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -6,3 +6,13 @@ __pycache__
 *.ini
 .pytest_cache
 .env
+
+# Slim build context — .git/ alone can be 100s of MB
+.git
+.github/
+docs/
+tests/
+
+# Exclude markdown files but keep www/src/*.md (used by WebsiteDeployer)
+*.md
+!www/**/*.md
diff --git a/.github/workflows/docker-build.yaml b/.github/workflows/docker-build.yaml
index 43ff0f80..6af8f085 100644
--- a/.github/workflows/docker-build.yaml
+++ b/.github/workflows/docker-build.yaml
@@ -72,3 +72,5 @@ jobs:
           labels: ${{ steps.meta.outputs.labels }}
           cache-from: type=gha
           cache-to: type=gha,mode=max
+          build-args: |
+            GIT_HASH=${{ github.sha }}
diff --git a/docker-compose.yaml b/docker-compose.yaml
index 487b24d8..066d3818 100644
--- a/docker-compose.yaml
+++ b/docker-compose.yaml
@@ -12,6 +12,8 @@ services:
     build:
       context: ./
       dockerfile: docker/chatmail_relay.dockerfile
+      args:
+        GIT_HASH: ${GIT_HASH:-unknown}
     image: chatmail-relay:latest
     restart: unless-stopped
     container_name: chatmail
diff --git a/docker/chatmail_relay.dockerfile b/docker/chatmail_relay.dockerfile
index 285c2451..73a3c09a 100644
--- a/docker/chatmail_relay.dockerfile
+++ b/docker/chatmail_relay.dockerfile
@@ -62,8 +62,12 @@ RUN cp -a www/ /opt/chatmail-www/
 
 RUN rm -f /tmp/chatmail.ini
 
-# Record image version for upgrade detection at runtime
-RUN git rev-parse HEAD > /etc/chatmail-image-version 2>/dev/null || echo "unknown" > /etc/chatmail-image-version
+# Record image version for upgrade detection at runtime.
+# GIT_HASH is passed as a build arg (from docker-compose or CI) so that
+# .git/ can be excluded from the build context via .dockerignore.
+ARG GIT_HASH=unknown
+RUN echo "$GIT_HASH" > /etc/chatmail-image-version && \
+    echo "$GIT_HASH" > /etc/chatmail-version
 # --- End build-time install ---
 
 ENV CHATMAIL_INI=/etc/chatmail/chatmail.ini