feat(agents): filter dockerignore files from entrypoint match

Author: rektdeckard

go.mod

@@ -16,6 +16,7 @@ require (
 	github.com/livekit/protocol v1.39.4-0.20250718180328-5934235d53ec
 	github.com/livekit/server-sdk-go/v2 v2.9.2-0.20250721202815-cc45e29e93d6
 	github.com/moby/buildkit v0.22.0
+	github.com/moby/patternmatcher v0.6.0
 	github.com/pion/rtcp v1.2.15
 	github.com/pion/rtp v1.8.20
 	github.com/pion/webrtc/v4 v4.1.3
@@ -130,7 +131,6 @@ require (
 	github.com/mitchellh/hashstructure/v2 v2.0.2 // indirect
 	github.com/moby/docker-image-spec v1.3.1 // indirect
 	github.com/moby/locker v1.0.1 // indirect
-	github.com/moby/patternmatcher v0.6.0 // indirect
 	github.com/moby/sys/signal v0.7.1 // indirect
 	github.com/morikuni/aec v1.0.0 // indirect
 	github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6 // indirect

pkg/agentfs/docker.go

@@ -25,6 +25,8 @@ import (
 	"strings"
 
 	"github.com/charmbracelet/huh"
+	"github.com/moby/patternmatcher"
+	"github.com/moby/patternmatcher/ignorefile"
 	"github.com/pkg/errors"
 
 	"github.com/livekit/livekit-cli/v2/pkg/util"
@@ -72,7 +74,7 @@ func CreateDockerfile(dir string, settingsMap map[string]string) error {
 
 	// TODO: (@rektdeckard) support Node entrypoint validation
 	if projectType.IsPython() {
-		dockerfileContent, err = validateEntrypoint(dir, dockerfileContent, projectType, settingsMap)
+		dockerfileContent, err = validateEntrypoint(dir, dockerfileContent, dockerIgnoreContent, projectType, settingsMap)
 		if err != nil {
 			return err
 		}
@@ -91,16 +93,32 @@ func CreateDockerfile(dir string, settingsMap map[string]string) error {
 	return nil
 }
 
-func validateEntrypoint(dir string, dockerfileContent []byte, projectType ProjectType, settingsMap map[string]string) ([]byte, error) {
+func validateEntrypoint(dir string, dockerfileContent []byte, dockerignoreContent []byte, projectType ProjectType, settingsMap map[string]string) ([]byte, error) {
 	valFile := func(fileName string) (string, error) {
 		// NOTE: we need to recurse to find entrypoints which may exist in src/ or some other directory.
 		// This could be a lot of files, so we omit any files in .dockerignore, since they cannot be
 		// used as entrypoints.
+
+		reader := bytes.NewReader(dockerignoreContent)
+		patterns, err := ignorefile.ReadAll(reader)
+		if err != nil {
+			return "", err
+		}
+		matcher, err := patternmatcher.New(patterns)
+		if err != nil {
+			return "", err
+		}
+
 		var fileList []string
 		if err := filepath.WalkDir(dir, func(path string, d os.DirEntry, err error) error {
 			if err != nil {
 				return err
 			}
+			if ignored, err := matcher.MatchesOrParentMatches(path); ignored {
+				return nil
+			} else if err != nil {
+				return err
+			}
 			if !d.IsDir() && strings.HasSuffix(d.Name(), ".py") {
 				fileList = append(fileList, path)
 			}
@@ -129,8 +147,7 @@ func validateEntrypoint(dir string, dockerfileContent []byte, projectType Projec
 			),
 		)
 
-		err := form.Run()
-		if err != nil {
+		if err := form.Run(); err != nil {
 			return "", err
 		}
 
@@ -153,7 +170,9 @@ func validateEntrypoint(dir string, dockerfileContent []byte, projectType Projec
 		line := lines[i]
 		trimmedLine := bytes.TrimSpace(line)
 
-		if bytes.HasPrefix(trimmedLine, []byte("ENTRYPOINT")) {
+		if bytes.HasPrefix(trimmedLine, []byte("ARG PROGRAM_MAIN")) {
+			result.WriteString(fmt.Sprintf("ARG PROGRAM_MAIN=\"%s\"", newEntrypoint))
+		} else if bytes.HasPrefix(trimmedLine, []byte("ENTRYPOINT")) {
 			// Extract the current entrypoint file
 			parts := bytes.Fields(trimmedLine)
 			if len(parts) < 2 {

pkg/agentfs/examples/python.pip.Dockerfile

@@ -7,6 +7,9 @@ FROM python:${PYTHON_VERSION}-slim
 # the application crashes without emitting any logs due to buffering.
 ENV PYTHONUNBUFFERED=1
 
+# Define the program entrypoint file where your agent is started
+ARG PROGRAM_MAIN="src/agent.py"
+
 # Create a non-privileged user that the app will run under.
 # See https://docs.docker.com/develop/develop-images/dockerfile_best-practices/#user
 ARG UID=10001
@@ -39,10 +42,10 @@ RUN python -m pip install --user --no-cache-dir -r requirements.txt
 COPY . .
 
 # ensure that any dependent models are downloaded at build-time
-RUN python main.py download-files
+RUN python "$PROGRAM_MAIN" download-files
 
 # expose healthcheck port
 EXPOSE 8081
 
 # Run the application.
-CMD ["python", "main.py", "start"]
+CMD ["python", "$PROGRAM_MAIN", "start"]

pkg/agentfs/examples/python.uv.Dockerfile

@@ -10,6 +10,9 @@ FROM ghcr.io/astral-sh/uv:python3.11-bookworm-slim
 # the application crashes without emitting any logs due to buffering.
 ENV PYTHONUNBUFFERED=1
 
+# Define the program entrypoint file where your agent is started
+ARG PROGRAM_MAIN="src/agent.py"
+
 # Create a non-privileged user that the app will run under.
 # See https://docs.docker.com/develop/develop-images/dockerfile_best-practices/#user
 ARG UID=10001
@@ -61,7 +64,7 @@ RUN uv sync --locked
 # Pre-download any ML models or files the agent needs
 # This ensures the container is ready to run immediately without downloading
 # dependencies at runtime, which improves startup time and reliability
-RUN uv run src/agent.py download-files
+RUN uv run "$PROGRAM_MAIN" download-files
 
 # Expose the healthcheck port
 # This allows Docker and orchestration systems to check if the container is healthy
@@ -70,4 +73,4 @@ EXPOSE 8081
 # Run the application using UV
 # UV will activate the virtual environment and run the agent
 # The "start" command tells the worker to connect to LiveKit and begin waiting for jobs
-CMD ["uv", "run", "src/agent.py", "start"]
+CMD ["uv", "run", "$PROGRAM_MAIN", "start"]