dockerfile 'RUN rm' possibly a security issue?

[bbannon]

I'm just starting to learn docker, so I may be wrong.
However, I saw a docker tutorial on youtube that seemed to say

RUN rm -f /var/www/html/includes/settings.php

doesn't really delete anything;
just creates a new layer on top,
leaving the old file in place in a 'hidden' layer.
Which hackers can find pretty easy.

I think a .dockerignore file is more what we want.
Don't copy the files in to start with.

.dockerignore contents:

.git
includes/settings,php
*.md

etc.