Every service builds with `context: ..`, and Docker only consults the .dockerignore at the context root — the copies under frontend/ and backend/ never applied, so the host's dist/, node_modules/ and caches were shipped into each build context.
