Invalid "recursive glob" in `.dockerignore` file when using Podman

[applejag]

What broke? What's expected?

Fails to build Docker image with Podman

It seems like buildah doesn't support recursive globs (aka "double star" **): containers/buildah#6417

Reproducing this issue

go mod init example.com/foobar

kubebuilder init --domain example.com --owner "Foobar" --project-name foobar --license none

make docker-build CONTAINER_TOOL=podman

$ make docker-build CONTAINER_TOOL=podman
podman build -t controller:latest .
[1/2] STEP 1/9: FROM golang:1.24 AS builder
[1/2] STEP 2/9: ARG TARGETOS
--> Using cache 99f3afb9706670e906a0a08c36623b20048f34a0ef3da60eb123885b6bce68f6
--> 99f3afb97066
[1/2] STEP 3/9: ARG TARGETARCH
--> Using cache 0f489bcc6ff6cc5cd9781c5e288d8d28760200b478aa5359b64608c9fcba2d81
--> 0f489bcc6ff6
[1/2] STEP 4/9: WORKDIR /workspace
--> Using cache fbcdd42d3ba09eeafc6aced94657267fc4f9fe731072ec922a62f1db011e7a66
--> fbcdd42d3ba0
[1/2] STEP 5/9: COPY go.mod go.mod
--> Using cache 3bd4e53a14f77b3b546f1209cdee5b2cae40ea435a0993146607fc7d4f127b3d
--> 3bd4e53a14f7
[1/2] STEP 6/9: COPY go.sum go.sum
--> Using cache cb11baf8e6d8d85d04da6e39339558d5d9c2019ef76138427ad4284a68b250fc
--> cb11baf8e6d8
[1/2] STEP 7/9: RUN go mod download
--> Using cache e2891f47d2926b5a6f21088ab16af0bafeee53aee9e9a2d4f549351c694e5d26
--> e2891f47d292
[1/2] STEP 8/9: COPY . .
--> Using cache 12c82b74a1e04a82d15d83d351c6e380d3b0cdeab1e7d8bbff12ee6611335623
--> 12c82b74a1e0
[1/2] STEP 9/9: RUN CGO_ENABLED=0 GOOS=${TARGETOS:-linux} GOARCH=${TARGETARCH} go build -a -o manager cmd/main.go
package cmd/main.go is not in std (/usr/local/go/src/cmd/main.go)
Error: building at STEP "RUN CGO_ENABLED=0 GOOS=${TARGETOS:-linux} GOARCH=${TARGETARCH} go build -a -o manager cmd/main.go": while running runtime: exit status 1
make: *** [Makefile:120: docker-build] Error 1

Removing the .dockerignore makes it work, but obviously makes it not ignore files anymore so the build cache gets tainted all of the time:

rm .dockerignore
make docker-build CONTAINER_TOOL=podman

KubeBuilder (CLI) Version

Version: cmd.version{KubeBuilderVersion:"v4.9.0", KubernetesVendor:"1.34.0", GitCommit:"unknown", BuildDate:"unknown", GoOs:"linux", GoArch:"amd64"}

PROJECT version

3

Plugin versions

- go.kubebuilder.io/v4

Other versions

$ go version
go version go1.25.2 linux/amd64

from go.mod:

go 1.24.5

require (
    github.com/onsi/ginkgo/v2 v2.22.0
    github.com/onsi/gomega v1.36.1
    k8s.io/apimachinery v0.34.0
    k8s.io/client-go v0.34.0
    sigs.k8s.io/controller-runtime v0.22.1
)

$ kubectl version --client
Client Version: v1.34.1
Kustomize Version: v5.7.1

Extra Labels

No response

[camilamacedo86]

Hey, thanks for raising this!

Officially, we only support Docker for now — mainly because it would be very hard for us to test and validate everything against all possible container tools.

However, see the following references:

• .dockerignore not working as expected in Podman 1.6.2 containers/buildah#2060
• https://docs.podman.io/en/latest/markdown/podman-build.1.html

The .dockerignore file should be supported by Podman/Buildah, so this looks like a Podman-specific issue rather than a problem in the Kubebuilder scaffolding itself. Hoowever, it seems have many bugs:

• dockerignore behaving differently in podman vs docker containers/podman#22910
• File based build secrets not accessible when using .dockerignore that excludes everything and adds exceptions containers/podman#25314
• **.md in .dockerignore is interpreted differently from Docker containers/buildah#6417

Also, note that simply removing .dockerignore is not a good solution, because it will copy all project files into the image — not just your Go source files.
That makes the image larger and breaks build caching efficiency.

I’d recommend:

• Checking whether the issue still occurs with the latest version of Podman/Buildah (since support for recursive globs and negations has been changing).

• If it still fails, try adjusting your Dockerfile to explicitly copy only what you need, for example:

  COPY go.mod go.sum ./
  RUN go mod download
  
  COPY cmd/ cmd/
  COPY api/ api/
  COPY controllers/ controllers/
  COPY internal/ internal/ 

This avoids relying on recursive ** patterns in .dockerignore and should build correctly with Podman as well.

[camilamacedo86]

Closing that as sorted out based in the above comment since it seems a bug with podman
However, if you have suggestions to improvements or you think that should be kept open please feel free to re-open this one.