title: Mount files in read-only volume (where source is in .dockerignore)
body: <p>My app depends on secrets, which I have stored in the folder <code>.credentials</code> (e.g. <code>.credentials/.env</code>, <code>.credentials/.google_api.json</code>, etc...) I don't want these files built into the docker image, however they need to be visible to the docker container.</p>
  
  <p>My solution is:</p>
  
  <ul>
  <li>Add <code>.credentials</code> to my .dockerignore</li>
  <li>Mount the credentials folder in read-only mode with a volume:</li>
  </ul>
  
  <pre><code># docker-compose.yaml
  version: '3'
  services:
    app:
      build: .
      volumes:
        - ./.credentials:/app/.credentials:ro
  </code></pre>
  
  <ol>
  <li><p>This is not working (I do not see any credentials inside the docker container). I'm wondering if the <code>.dockerignore</code> is causing the volume to break, or if I've done something else wrong?</p></li>
  <li><p>Am I going about this the wrong way? e.g. I could just pass the <code>.env</code> file with <code>docker run IMAGE_NAME --env-file .env</code></p></li>
  </ol>
  
  <p>Edit:</p>
  
  <p>My issue was to do with how I was running the image. I was doing <code>docker-compose build</code> and then <code>docker run IMAGE_NAME</code>, assuming that the volumes were build into the image. However this seems not to be the case. </p>
  
  <p>Instead <strong>the above code works</strong> when I do <code>docker-compose run app</code>(where app is the service name) after building.</p>