vibehacker
Discuss
Drew Moore
1 month ago

cascade wiped half my .dockerignore and baked node_modules into the image

#agents#vibe-coding#tooling
Windsurf
Agentic IDE with Cascade — multi-file AI coding from Codeium

asked Windsurf Cascade to "speed up docker builds" on a Next.js API. it opened .dockerignore, deleted the node_modules and .next lines, and left a smug comment that caching would handle it.

docker build finished in 4 minutes looking "optimized". image was 3.1GB. du -sh inside the container showed a full node_modules tree plus my local .env.local because that line got dropped too.

caught it before push because the registry upload stalled at 40%. Mac M2, Cascade on the $20/mo plan. now .dockerignore is in the denylist. if an agent wants to "help" with docker it can open a PR, not rewrite the ignore file mid-session.

7

7 comments

Join the discussion

Log in to comment.

Log in
  • Tomek Wiśniewski

    this is why image size assert belongs in CI. we fail the job if the artifact goes over 400MB. agent "optimizations" that drop ignore rules never show up in unit tests.

    also .env.local in the layer is not a cute oops, that is a secret leak waiting for a push. you got lucky the upload stalled.

    • Carlos Reed

      same class of fail with Claude Code last week — it "cleaned" a monorepo Dockerfile and removed the pnpm store exclusion. build went green on my laptop, CI runners OOM'd at 14GB.

      size assert is the right call. I also started grepping the agent diff for .dockerignore and Dockerfile* before Accept. if either file moves, I read every line.

      • Kai

        the grep-before-accept habit is good. do you also pin a max layer size in the Dockerfile itself, or only the CI assert?

        i tried hadolint rules on agent PRs — caught a dropped .git ignore once, missed a sneaky COPY . . reorder. still figuring out the right gate.

        • Amara Nwosu

          only the CI assert for us. two engineers, we don't have time to babysit Dockerfile pins.

          claude code tried a HEALTHCHECK rewrite friday that looked clean and still shoved a 1.2gb layer. size gate caught it; hadolint didn't. what's your threshold?

  • Remy

    same failure mode with Continue last tuesday — it "tidied" .dockerignore and dropped *.pem. image went from 420mb to 2.4gb on our GH runners.

    i now fail the workflow if docker history shows a layer > 800MB. crude, but the agent stopped touching ignore files after the second red build.

  • Elena

    had cascade do almost the same thing on a fastapi image last month. deleted the .venv ignore line, image jumped from 280mb to 1.9gb. mac m1, same $20 plan.

    i now keep a one-line CI check: grep -q node_modules .dockerignore || exit 1. crude. saved me twice already.

    • Evan Liu

      Same class of fail. I keep a CI gate: grep -E '^(node_modules|\.env)' .dockerignore || exit 1 plus a max image size assert at 500MB.

      Cascade "optimized" our Next image last week by deleting the .next ignore. Build looked faster. Artifact was 2.8GB. Grep gate caught it; unit tests did not. Agents do not get to touch ignore files without a human reading the diff.

More like this

View all