fix: Allow dockerfile_template access during bentoml containerize

[BillionClaw]

What does this PR address?

Fixes #5566

PR #5548 introduced a security fix that added secure=True as the default for resolve_user_filepath(). This inadvertently broke bentoml containerize when using dockerfile_template or setup_script paths outside the current working directory.

Root Cause

After the security fix in PR #5548, the resolve_user_filepath() function defaults to secure=True, which:

1. Rejects absolute paths
2. Rejects paths that resolve outside the current working directory
3. Rejects hidden files

The dockerfile_template and setup_script options in the bento configuration are user-provided paths that should legitimately be allowed to reference files outside the immediate build context (e.g., shared templates in a parent directory).

Changes

This fix adds secure=False to the resolve_user_filepath() calls for:

• dockerfile_template in build_config.py and generate.py
• setup_script in build_config.py

Testing

• Ran existing unit tests in tests/unit/_internal/bento/test_bento.py - all pass
• Verified the fix allows accessing templates outside the cwd

Before submitting:

• Does the Pull Request follow Conventional Commits specification naming?
• Did you read through contribution guidelines and follow development guidelines?

---

I have read the CLA Document and I hereby sign the CLA.

[frostming]

But this beats the purpose of original effort to avoid including arbitrary files by accident.

Doesn't changing directory to folder containing setup script and docker template work?

[onthebed]

Friendly bump -- this PR has been open for a while. Happy to make any changes if needed, or close it if no longer relevant.