instruction: Create a Dockerfile for fundamentals
output: ```dockerfile
  from unintended side effects or
  security risks. The --allow flag explicitly grants access to additional
  entitlements, making it clear when a build or bake operation requires elevated
  privileges.In addition to BuildKit's network.host and security.insecure entitlements
  (see
  docker buildx build --allow,
  Bake supports file system entitlements that grant granular control over file
  system access. These are particularly useful when working with builds that need
  access to files outside the default working directory.Bake supports the following filesystem entitlements:--allow fs=<path|*> - Grant read and write access to files outside of the
  working directory.--allow fs.read=<path|*> - Grant read access to files outside of the
  working directory.--allow fs.write=<path|*> - Grant write access to files outside of the
  working directory.The fs entitlements take a path value (relative or absolute) to a directory
  on the filesystem. Alternatively, you can pass a wildcard (*) to allow Bake
  to access the entire filesystem.Example: fs.readGiven the following Bake configuration, Bake would need to access the parent
  directory, relative to the Bake file.
  
  target "app" {
   context = "../src"
  }Assuming docker buildx bake app is executed in the same directory as the
  docker-bake.hcl file, you would need to explicitly allow Bake to read
  ```