ecr-assets: incomplete .dockerignore support

Introduced by #4104.

CDK does not handle the common “exclude everything except” pattern for .dockerignore files:

# Ignore everything
*
# Allow files and directories
!/src/**

Quote from Docker docs:

… you may want to specify which files to include in the context, rather than which to exclude. To achieve this, specify * as the first pattern, followed by one or more ! exception patterns.

With the current implementation the first ‘star’ glob effectively excludes everything from the asset folder dyring synth stage. Consequently, deploy stage fails to build the docker image.

Reproduction Steps

1. Create a .dockerignore file next to you Dockerfile with * pattern, like this:

   # Ignore everything
   *
   # Allow files and directories
   !/src/**
   

2. Run cdk deploy

Error Log

unable to prepare context: unable to evaluate symlinks in Dockerfile path: CreateFile C:\Dev\GitHub\playground\EcsWindowsCluster\src\Deployment\cdk.out\asset.1ebc9d3ac2033816c4abb63e4afd69d350b4aba8704cc9236b82ea520b74f4b0\Dockerfile: The system cannot find the file specified.

 ❌  win failed: Error: docker build --tag 305168429857.dkr.ecr.eu-west-1.amazonaws.com/cdk/win:latest cdk.out\asset.1ebc9d3ac2033816c4abb63e4afd69d350b4aba8704cc9236b82ea520b74f4b0 exited with error code 1
docker build --tag 305168429857.dkr.ecr.eu-west-1.amazonaws.com/cdk/win:latest cdk.out\asset.1ebc9d3ac2033816c4abb63e4afd69d350b4aba8704cc9236b82ea520b74f4b0 exited with error code 1

Environment

• CLI Version : 1.12.0 (build 923055e)
• OS : Windows

---

This is 🐛 Bug Report

[enricopesce]

I have today the same problem with:

cdk 1.103.0 (build bc13a66)

@aws-cdk/assets 1.103.0

OS: osx 11.3.1

typescript language

[nmussy]

Here’s what I’ve found:

copyDirectory walks through each directory recursively, making sure they’re not excluded. If the directory is excluded, its files and sub-directories won’t be explored:

https://github.com/aws/aws-cdk/blob/dcd8d1e8ccc7330ea14e292b5ccc855e0e15bbdf/packages/%40aws-cdk/assets/lib/fs/copy.ts#L21-L23

shouldExclude on the other hand matches .dockerignore lines against the path it’s being provided:

https://github.com/aws/aws-cdk/blob/dcd8d1e8ccc7330ea14e292b5ccc855e0e15bbdf/packages/%40aws-cdk/assets/lib/fs/utils.ts#L20

So in the case of publish/good.txt, publish is evaluated against each .dockerignore line.

• * matches publish, and excludes the directory
• !publish\* does not match publish
• copyDirectory leaves the directory early, without having checked its files

We need to figure out how to affect either shouldExclude or copyDirectory to prevent the recursion from stopping early