diff --git a/.github/workflows/release/Dockerfile b/.github/workflows/release/Dockerfile
index 8023bf880..979b3e9ec 100644
--- a/.github/workflows/release/Dockerfile
+++ b/.github/workflows/release/Dockerfile
@@ -56,7 +56,7 @@ RUN \
 # check git working tree after build
 RUN \
 	export GIT_STATUS_OUTPUT=$(git status --porcelain) && \
-	test -z $GIT_STATUS_OUTPUT || (echo $GIT_STATUS_OUTPUT && exit 1)
+	test -z $GIT_STATUS_OUTPUT || (echo "repository contains uncommitted changes" && exit 1)
 
 FROM scratch AS release
 COPY --from=target /go/src/github.com/containerd/containerd/releases/ /
diff --git a/.github/workflows/release/Dockerfile.dockerignore b/.github/workflows/release/Dockerfile.dockerignore
new file mode 100644
index 000000000..c553fed57
--- /dev/null
+++ b/.github/workflows/release/Dockerfile.dockerignore
@@ -0,0 +1,19 @@
+# Exclude files that may cause cache-busts. These are generally expected
+# to be in a global .gitignore, but still can cause the build-cache to
+# be invalidated.
+**/.DS_Store
+
+# exclusions below are copied from .gitignore at the root of the repository
+# when updating, consider updating .gitignore accordingly.
+
+/bin/
+/man/
+coverage.txt
+profile.out
+containerd.test
+_site/
+# Allow repeated builds without copying back previous builds
+releases/*.tar.gz
+releases/*.tar.gz.sha256sum
+_output/
+.vagrant/