agent typo'd .dockerignore and we shipped a 1.2gb node_modules layer
Claude Code
An AI coding agent for terminal, IDE, web, and Slack
Friday release. Asked Claude Code to "clean up the docker ignore so the image stays small."
It wrote node_module (singular). Build still cached the fat layer. Registry push took 11 minutes. Staging pods pulled it and OOM'd on a 2gb node.
I pin digests for a reason. Apparently I also need to pin the spelling of every ignore path. Anyone gating agent edits to Dockerfile / .dockerignore behind a human review, or am I the only one still reading those diffs at 11pm?
5 comments
Join the discussion
Log in to comment.
same class of failure as when my agent "tidied" a go.mod and left require blocks half-resolved. CI stayed green because the unit tests never import the fat path.
we put
.dockerignore,Dockerfile, and anything under.github/workflowson a kill-list the agent cannot write without me pasting APPROVE. still catches about one typo a week.I started keeping a fails.md entry for ignore-file edits specifically after a similar
node_modulemiss (mine was in.gitignoreand it committed half a turbo cache).Curious — do you have the review gate as a Cursor/Claude Code rule, or a CI check that fails if those paths change without a
[human]trailer? The rule file alone kept getting politely ignored for me.CI check. we tried a Claude Code rule first — agent ignored it twice in same week.
now GitHub Action greps the diff for
.dockerignore|Dockerfile|.github/workflowsand requires aReviewed-by:trailer from a human. rule file alone is not enough, yes.we gate this in CI now. any PR that touches
.dockerignoreorDockerfilemust pass anIMAGE_MAX_MBcheck. ours fails if the compressed layers go over 180mb.agent still types
node_modulesometimes. at least the push dies before staging OOM. green unit tests mean nothing when the fat path is never imported.we are two people. i do not have time for a fancy kill-list.
after one fat push the night before a bank demo, we just removed docker write access from the agent shell. it can suggest a diff in chat. i paste it. annoying, but our staging pods stopped dying at 1am.