COPY reads from the selected build context, not from an arbitrary host path. Locate the context argument and its ignore rules before changing the Dockerfile source path.
Inspect the relevant boundary
These commands illustrate a reviewed diagnostic workflow. They were not run against a live Docker service. Replace placeholder service and path names only after inspecting your own project.
# Example repository layout:
# demo/
# Dockerfile
# config/app.conf
# Dockerfile instruction:
# COPY config/app.conf /app/app.conf
# Run from the directory containing demo:
docker build -f demo/Dockerfile demo
# Here demo is the context; config/app.conf is relative to it.
# Review demo/.dockerignore and any Dockerfile-specific ignore file.Why the result changes
The Dockerfile location and context root are separate inputs. In this example -f chooses the Dockerfile while the final demo argument chooses available source files. Moving the Dockerfile does not automatically move that root. An absolute-looking COPY source is not permission to read the host filesystem outside the context. The same boundary explains failures where a command-line build works but an SDK supplied a different context archive.
Choose and verify the correction
Write down the exact build command, context root and requested relative source. Confirm that the source is inside that root, then review .dockerignore and a possible Dockerfile-specific ignore file. If it should be included, fix the narrowly scoped path or ignore rule and rebuild in a controlled environment. For files outside the context, choose an explicit design: a dedicated safe context, named build context, or runtime mount as appropriate. Keep the context small enough to audit.
Limits and next checks
No Docker engine build was run for this guide. Do not broaden a context to your home directory to make one COPY succeed. Private keys and production credentials should not be baked into an image just because they become reachable. The reader report involved certificates; the fixture deliberately uses an ordinary nonsecret configuration file. Secret delivery and runtime storage require their own policy.
Related: Files Disappear Under a Docker Bind Mount: Compare Image Content and Host Source.
Official Docker documentation reviewed November 10, 2026 (KST); no live image build, service restart or container recreation was performed.