Document excludes and container_exit.sh

Closes #612

Signed-off-by: Jonathon Anderson <janderson@ciq.co>

userdocs/contents/containers.rst

@@ -183,6 +183,37 @@ If the files ``/etc/passwd`` or ``/etc/group`` were updated, there
 will be an additional check to confirm if the users are in sync as
 described in `Syncuser`_ section.
 
+Excluding Files from a Container
+--------------------------------
+
+Warewulf can exclude files from a source container to prevent them
+from being delivered to the compute node. This is typically used to
+reduce the size of the image when some files are unnecessary.
+
+Patterns for excluded files are read from the file
+``/etc/warewulf/excludes`` in the container image itself. For example,
+the default Rocky Linux images exclude these paths:
+
+.. code-block::
+
+   /boot/
+   /usr/share/GeoIP
+
+``/etc/warewulf/excludes`` supports the patterns implemented by
+`filepath.Match <https://pkg.go.dev/path/filepath#Match>`_.
+
+Preparing a container for build
+-------------------------------
+
+Warewulf executes the script ``/etc/warewulf/container_exit.sh`` after
+a ``wwctl container shell`` or ``wwctl container exec`` and prior to
+(re)building the final node image for delivery. This is typically used
+to remove cache or log files that may have been generated by the
+executed command or interactive session.
+
+For example, the default Rocky Linux images runs ``dnf clean all`` to
+remove any package repository caches that may have been generated.
+
 Creating Containers From Scratch
 ================================