buildah `**.md` in .dockerignore is interpreted differently from Docker

Issue Description

Podman interprets dockerignore patterns like **.md and **.html differently from Docker. For example, when **.md is listed in .dockerignore,

Docker ignores README.md, foo/README.md, ... but
Podman does not ignore README.md, foo/README.md, ...

Is this difference expected or a known issue?

Steps to reproduce the issue

Create an empty directory.

Create Dockerfile in the directory with the following content:

FROM docker.io/library/busybox
ADD . /docker-vs-podman/
ENTRYPOINT [ "find", "/docker-vs-podman/" ]

Create .dockerignore in the directory with the following content:
```
**.md
```
Create empty files at README.md and foo/README.md in the directory.

Create an image and run the container using Docker:

docker build -t docker-vs-podman .
docker run --rm docker-vs-podman  # does not includes README.md and foo/README.md

Create an image and run the container using Podman:

podman build -t docker-vs-podman .
podman run --rm docker-vs-podman  # includes README.md and foo/README.md

Describe the results you received

Output of Step 5 above:

/docker-vs-podman/
/docker-vs-podman/Dockerfile
/docker-vs-podman/.dockerignore
/docker-vs-podman/foo

Output of Step 6:

/docker-vs-podman/
/docker-vs-podman/Dockerfile
/docker-vs-podman/README.md
/docker-vs-podman/.dockerignore
/docker-vs-podman/foo
/docker-vs-podman/foo/README.md

Describe the results you expected

Ideally, Podman should ignore the same files (README.md and foo/README in the example above).

podman info output

host:
  arch: arm64
  buildahVersion: 1.40.1
  cgroupControllers:
  - cpuset
  - cpu
  - io
  - memory
  - hugetlb
  - pids
  - rdma
  cgroupManager: cgroupfs
  cgroupVersion: v2
  conmon:
    package: conmon_2.1.10+ds1-1build2_arm64
    path: /usr/bin/conmon
    version: 'conmon version 2.1.10, commit: unknown'
  cpuUtilization:
    idlePercent: 93.15
    systemPercent: 2.22
    userPercent: 4.63
  cpus: 12
  databaseBackend: sqlite
  distribution:
    codename: noble
    distribution: ubuntu
    version: "24.04"
  eventLogger: file
  freeLocks: 2048
  hostname: f664d04c01cf
  idMappings:
    gidmap: null
    uidmap: null
  kernel: 6.10.14-linuxkit
  linkmode: dynamic
  logDriver: k8s-file
  memFree: 7581413376
  memTotal: 50428837888
  networkBackend: netavark
  networkBackendInfo:
    backend: netavark
    dns:
      package: aardvark-dns_1.4.0-5_arm64
      path: /usr/lib/podman/aardvark-dns
      version: aardvark-dns 1.4.0
    package: netavark_1.4.0-4_arm64
    path: /usr/lib/podman/netavark
    version: netavark 1.4.0
  ociRuntime:
    name: runc
    package: containerd.io_1.7.27-1_arm64
    path: /usr/bin/runc
    version: |-
      runc version 1.2.5
      commit: v1.2.5-0-g59923ef
      spec: 1.2.0
      go: go1.23.7
      libseccomp: 2.5.5
  os: linux
  pasta:
    executable: /usr/bin/pasta
    package: passt_0.0~git20240220.1e6f92b-1_arm64
    version: |
      pasta unknown version
      Copyright Red Hat
      GNU General Public License, version 2 or later
        <https://www.gnu.org/licenses/old-licenses/gpl-2.0.html>
      This is free software: you are free to change and redistribute it.
      There is NO WARRANTY, to the extent permitted by law.
  remoteSocket:
    exists: true
    path: /run/podman/podman.sock
  rootlessNetworkCmd: pasta
  security:
    apparmorEnabled: false
    capabilities: CAP_CHOWN,CAP_DAC_OVERRIDE,CAP_FOWNER,CAP_FSETID,CAP_KILL,CAP_NET_BIND_SERVICE,CAP_SETFCAP,CAP_SETGID,CAP_SETPCAP,CAP_SETUID,CAP_SYS_CHROOT
    rootless: false
    seccompEnabled: true
    seccompProfilePath: ""
    selinuxEnabled: false
  serviceIsRemote: false
  slirp4netns:
    executable: /usr/bin/slirp4netns
    package: slirp4netns_1.2.1-1build2_arm64
    version: |-
      slirp4netns version 1.2.1
      commit: 09e31e92fa3d2a1d3ca261adaeb012c8d75a8194
      libslirp: 4.7.0
      SLIRP_CONFIG_VERSION_MAX: 4
      libseccomp: 2.5.5
  swapFree: 4294963200
  swapTotal: 4294963200
  uptime: 34h 40m 36.00s (Approximately 1.42 days)
  variant: v8
plugins:
  authorization: null
  log:
  - k8s-file
  - none
  - passthrough
  network:
  - bridge
  - macvlan
  - ipvlan
  volume:
  - local
registries: {}
store:
  configFile: /etc/containers/storage.conf
  containerStore:
    number: 0
    paused: 0
    running: 0
    stopped: 0
  graphDriverName: vfs
  graphOptions: {}
  graphRoot: /var/lib/containers/storage
  graphRootAllocated: 2163360055296
  graphRootUsed: 114402852864
  graphStatus: {}
  imageCopyTmpDir: /var/tmp
  imageStore:
    number: 7
  runRoot: /run/containers/storage
  transientStore: false
  volumePath: /var/lib/containers/storage/volumes
version:
  APIVersion: 5.5.2
  Built: 1756466747
  BuiltTime: Fri Aug 29 11:25:47 2025
  GitCommit: ""
  GoVersion: go1.23.3
  Os: linux
  OsArch: linux/arm64
  Version: 5.5.2

Podman in a container

Yes

Privileged Or Rootless

Privileged

Upstream Latest Release

No

Additional environment details

None

Additional information

From what I’ve seen in the implementation,

Docker switches to a special logic (suffix matching) when it finds ** at the beginning,^docker while
Podman simply converts **.md into a regular expression (.*/)?\.md,^podman which matches only .md, foo/.md, ...

(I'm not a contributor to either Docker or Podman, so my observation may be inaccurate.)

I also found some real-world instances of this patterns:

https://github.com/yetanotherco/aligned_layer/blob/15e7eec35c3f38ef24c6bc70f553d88f14436af4/.dockerignore#L14
https://github.com/taskcluster/taskcluster/blob/29e6e3918124efc31840fac11667f675d28ffc67/.dockerignore#L8

Oct 08 '25 06:10 tomokinakamaru

@flouthoc wdyt here? bug? should this be transfered to buildah ?

Oct 08 '25 14:10 baude

This is compatiblity issue with buildah, docker supports globbing over any any depth using ** but buildah only supports are root level.

Moving this to buildah.

Oct 08 '25 15:10 flouthoc

Thank you for the resonse! and sorry for opening this issue in the wrong repository :(

Oct 08 '25 23:10 tomokinakamaru

A friendly reminder that this issue had no activity for 30 days.

Nov 08 '25 00:11 github-actions[bot]