RUN bind mount cache calculation

[jsirex]

This is either bug or feature. it depends. Probably we should be strictly consistent with Docker.
From docs about "RUN bind mount":

from	Build stage, context, or image name for the root of the source. Defaults to the build context.

It is typical use-case nowadays to RUN bind-mount some files instead of COPY & RUN. And, default context means build context. And here is the probably the issue: https://github.com/containers/buildah/pull/5691/files#diff-8dcc4ae6a1f2562a657fa8059a140f18e5aa34e44836ad1991ed84d0c75ea46eR44

During calculation of checksums we are walking through all files.
But we should consider only files in build context. So we must honor dockerignore/containerignore files too.

In my use-case I have python project (which is small) and venv directory for dependencies.
The venv directory is git- and container- ignored. And yes, sometimes (hi torch/nvidia), it huge - 6.8 GB.

I don't know what is proper behavior here, I tested it on latest podman/buildah.
And I'm having the following:

❯ cat Containerfile 
FROM docker.io/library/debian:trixie

WORKDIR /experiment
RUN --mount=type=bind,target=/experiment ls -lha /experiment

❯ cat .containerignore
.test/

Building first time:

❯ podman build ./
STEP 1/3: FROM docker.io/library/debian:trixie
STEP 2/3: WORKDIR /experiment
--> Using cache 27aeded6a6c593b738755933b30a493b52be239e97f4daa25408b4a4c6fc3f57
--> 27aeded6a6c5
STEP 3/3: RUN --mount=type=bind,target=/experiment ls -lha /experiment
total 12K
drwxrwxr-x 3 root root  100 Feb 25 13:56 .
dr-xr-xr-x 1 root root 4.0K Feb 25 13:57 ..
-rw-rw-r-- 1 root root    7 Feb 25 13:56 .containerignore
drwxrwxr-x 2 root root   60 Feb 25 13:55 .test
-rw-rw-r-- 1 root root  119 Feb 25 13:55 Containerfile
COMMIT
--> fabc6ab1ca81
fabc6ab1ca814d4f95324eca417783ca53801fc2d2f436ff5e1b7da62fa93b0e

Building second time - cache used:

❯ podman build ./
STEP 1/3: FROM docker.io/library/debian:trixie
STEP 2/3: WORKDIR /experiment
--> Using cache 27aeded6a6c593b738755933b30a493b52be239e97f4daa25408b4a4c6fc3f57
--> 27aeded6a6c5
STEP 3/3: RUN --mount=type=bind,target=/experiment ls -lha /experiment
--> Using cache fabc6ab1ca814d4f95324eca417783ca53801fc2d2f436ff5e1b7da62fa93b0e
--> fabc6ab1ca81
fabc6ab1ca814d4f95324eca417783ca53801fc2d2f436ff5e1b7da62fa93b0e

Changing directory which should be ignored and build - cache invalidates:

❯ echo 123 > .test/two

❯ podman build ./
STEP 1/3: FROM docker.io/library/debian:trixie
STEP 2/3: WORKDIR /experiment
--> Using cache 27aeded6a6c593b738755933b30a493b52be239e97f4daa25408b4a4c6fc3f57
--> 27aeded6a6c5
STEP 3/3: RUN --mount=type=bind,target=/experiment ls -lha /experiment
total 12K
drwxrwxr-x 3 root root  100 Feb 25 13:56 .
dr-xr-xr-x 1 root root 4.0K Feb 25 13:57 ..
-rw-rw-r-- 1 root root    7 Feb 25 13:56 .containerignore
drwxrwxr-x 2 root root   80 Feb 25 13:57 .test
-rw-rw-r-- 1 root root  119 Feb 25 13:55 Containerfile
COMMIT
--> dcedbb877092
dcedbb8770928814320a05f12a4e5f4f133548c807f072ea500a2c63f110a2b7

(1) RUN statement just binds directory with all files, and I think we can live with it
(2) buildah calculates checksums based on folder ignoring .containerignore file. And that is probably the bug.
(3) Calculating of checksums for root context takes significant amount of time.

[flouthoc]

@jsirex Good finding, I think process of checksum calculation must honor .*ignore files and we must fix this in buildah. @nalind WDYT ?

[nalind]

Yes, the ignores would need to be processed when mounting the default build context.