Summary

The default Docker build context should exclude local runtime state directories used by compose/profile setups, such as hermes-config/ and runtime/.

This is a hygiene request to reduce accidental secret/runtime-state inclusion in Docker build context and avoid rebuild failures caused by host-side runtime file ownership.

Why this matters

Compose/profile setups commonly keep runtime state outside the image and mount it into the container. Those directories can contain:

• config files and auth/session state;
• local runtime databases/logs/cache;
• files owned by the container runtime user;
• user/private deployment artifacts.

Including those directories in Docker build context is unnecessary and can cause:

• slow builds;
• accidental local data exposure to the build context;
• rebuild failures when the Docker client cannot read runtime-owned files.

Current behavior in vanilla Hermes

.dockerignore excludes data/, but does not exclude common compose/profile runtime directories such as hermes-config/ or runtime/.

# Runtime data (bind-mounted at /opt/data; must not leak into build context)
data/

Requested behavior

Add common runtime-state directories to .dockerignore, for example:

hermes-config/
runtime/

Suggested acceptance criteria

• Docker build context excludes local compose/profile runtime state.
• Existing source files required for image builds are unaffected.
• The change is safe for users who do not use those directories.