build: add SSH agent socket forwarder (`docker build --ssh $SSHMOUNTID=$SSH_AUTH_SOCK`) #1419

AkihiroSuda · 2018-10-05T10:48:02Z

Signed-off-by: Akihiro Suda suda.akihiro@lab.ntt.co.jp

- What I did

This commit adds SSH agent socket forwarder (docker build --ssh $SSHMOUNTID=$SSH_AUTH_SOCK) .

Unlike docker build --secret, docker build --ssh allows the build container to use SSH keys with passphrases.

$ eval $(ssh-agent)
$ ssh-add ~/.ssh/id_rsa
(Input your passphrase here)
$ docker build --ssh default=$SSH_AUTH_SOCK ...

This feature requires the daemon with CapExecMountSSH build capability (moby/moby#37973) .

Currently, the official Dockerfile frontend does not provide the syntax for using the SSH forwarder.

However, the experimental RUN --mount=type=ssh syntax can be enabled by using
the Dockerfile frontend image built with the BUILDTAGS="dfrunmount dfssh", via the # syntax = "shebang".

The Dockerfile for the Dockerfile frontend is available at https://github.com/moby/buildkit/tree/master/frontend/dockerfile/cmd/dockerfile-frontend .
A pre-built image is also available as tonistiigi/dockerfile:ssh20181002 .

An example Dockerfile with RUN --mount=type=ssh:

# syntax = tonistiigi/dockerfile:ssh20181002
FROM alpine
RUN apk add --no-cache openssh-client
RUN mkdir -p -m 0700 ~/.ssh && ssh-keyscan gitlab.com >> ~/.ssh/known_hosts
RUN --mount=type=ssh ssh git@gitlab.com | tee /hello
# "Welcome to GitLab, @GITLAB_USERNAME_ASSOCIATED_WITH_SSHKEY" should be printed here

More info available at moby/buildkit#608, moby/buildkit#655

- How I did it

See above

- How to verify it

See above

- Description for the changelog

build: add SSH agent socket forwarder (docker build --ssh $SSHMOUNTID=$SSH_AUTH_SOCK)

- A picture of a cute animal (not mandatory but encouraged)

Signed-off-by: Akihiro Suda <suda.akihiro@lab.ntt.co.jp>

AkihiroSuda · 2018-10-05T10:48:44Z

(probably this is too late for v18.09)

AkihiroSuda · 2018-10-05T10:49:01Z

@tonistiigi @tiborvass @ijc

…D=$SSH_AUTH_SOCK`) Unlike `docker build --secret`, `docker build --ssh` allows the build container to use SSH keys with passphrases. $ eval $(ssh-agent) $ ssh-add ~/.ssh/id_rsa (Input your passphrase here) $ docker build --ssh default=$SSH_AUTH_SOCK ... This feature requires the daemon with `CapExecMountSSH` build capability (moby/moby#37973) . Currently, the official Dockerfile frontend does not provide the syntax for using the SSH forwarder. However, the experimental `RUN --mount=type=ssh` syntax can be enabled by using the Dockerfile frontend image built with the `BUILDTAGS="dfrunmount dfssh"`, via the `# syntax =` "shebang". The Dockerfile for the Dockerfile frontend is available at github.com/moby/buildkit/frontend/dockerfile/cmd/dockerfile-frontend) The pre-built image is also available as `tonistiigi/dockerfile:ssh20181002` . An example Dockerfile with `RUN --mount=type=ssh`: # syntax = tonistiigi/dockerfile:ssh20181002 FROM alpine RUN apk add --no-cache openssh-client RUN mkdir -p -m 0700 ~/.ssh && ssh-keyscan gitlab.com >> ~/.ssh/known_hosts RUN --mount=type=ssh ssh git@gitlab.com | tee /hello # "Welcome to GitLab, @GITLAB_USERNAME_ASSOCIATED_WITH_SSHKEY" should be printed here More info available at moby/buildkit#608, moby/buildkit#655 Signed-off-by: Akihiro Suda <suda.akihiro@lab.ntt.co.jp>

codecov-io · 2018-10-05T10:56:46Z

Codecov Report

Merging #1419 into master will decrease coverage by 0.05%.
The diff coverage is 8.69%.

@@            Coverage Diff             @@
##           master    #1419      +/-   ##
==========================================
- Coverage   54.26%   54.21%   -0.06%     
==========================================
  Files         289      289              
  Lines       19331    19353      +22     
==========================================
+ Hits        10490    10492       +2     
- Misses       8165     8185      +20     
  Partials      676      676

vdemeester

SGTM 😍

tonistiigi · 2018-10-05T21:27:28Z

@AkihiroSuda @tiborvass @vdemeester Are we sure about this syntax. I don't have better ideas but didn't give it that much thought when I added this in buildctl. The default constant seems weird but don't really have a way around that.

Btw. docker build --ssh default=$SSH_AUTH_SOCK is the same as docker build --ssh default.

tiborvass · 2018-10-05T22:13:46Z

For the record, the easiest way is to do docker build --ssh default without even specifying the auth socket. Tested it with tonistiigi/dockerfile:ssh20181005 which has support for required as so: RUN --mount=type=ssh,required ...

LGTM

tiborvass · 2018-10-05T22:43:07Z

@tonistiigi I think the word default is fine. For those wondering why we need a word at all: the rationale is that we should enable security-minded people who want to specify different keys for different projects/endpoints. Those can be differentiated via IDs for RUN --mount.

RUN --mount=type=ssh,id=myrepo1 ssh ...
RUN --mount=type=ssh,id=myrepo2 ssh ...

A CI could do docker build --ssh myrepo1=/path/to/myrepo1-readonly.pem --ssh myrepo2=/path/to/myrepo2-readonly.pem ... while a user using an SSH agent would simply have to do: docker build --ssh myrepo1 --ssh myrepo2 ...

In order to allow that granularity, we need a default ID... and I'm fine with default.

cpuguy83 · 2018-10-06T18:28:01Z

I would call this something like "forward-ssh" or "ssh-agent".
Other than that, I wonder if there's some magic we can do with the flag parser to have the flag value be optional and rather treat it like a bool flag that can potentially have a string value.

thaJeztah · 2018-10-06T18:30:54Z

Had the same thought as Brian, but only was able to have a very brief look

…

On 6 Oct 2018, at 20:28, Brian Goff ***@***.***> wrote: I would call this something like "forward-ssh" or "ssh-agent". Other than that, I wonder if there's some magic we can do with the flag parser to have the flag value be optional and rather treat it like a book flag that can potentially have a string value. — You are receiving this because your review was requested. Reply to this email directly, view it on GitHub, or mute the thread.

tonistiigi · 2018-10-07T04:36:24Z

Note that this syntax allows direct keys as well, and that should be the preferred way to use in CI (with special deploy keys). So this is not only for forwarding the pre-created ssh agent socket.

tiborvass · 2018-10-08T21:11:15Z

@cpuguy83 @thaJeztah so are you okay with this?

cpuguy83

Spoke with @tiborvass on this at length.
In short, here's what's happening:

--ssh default is really --ssh default=${SSH_AUTH_SOCK}.
This could just as easily be --ssh default=/path/to/private.key.

What happens here is buildkit (in the client) determines if the value is a socket or a regular file and creates an agent accordingly. The buildkit daemon can later send a request for the agent with the requested key.
The container will then get an SSH_AUTH_SOCK environment variable and the socket mounted inside.

I still think the flag name could be a bit more descriptive --forward-ssh or --ssh-key, but tbh --ssh works as well and I can't think of another use for the flag.

As for magic, in the CLI flag... if it's even possible to do it, we can add it later without breaking anything.

LGTM

tiborvass · 2018-10-09T20:42:47Z

Thanks @cpuguy83 ! Just to clarify, the magic referred to is to be able to parse --ssh alone without argument to mean the same thing as --ssh default. It would be a bit too magical and could be prone to error cases. Agree that for now we can keep it simple.

AkihiroSuda · 2018-10-10T01:15:39Z

Is this ready for 18.09?

seemethere · 2018-10-10T01:16:55Z

Feature complete date for 18.09 was back in September so this most likely will not make the GA for 18.09.0

thaJeztah · 2018-10-10T16:08:29Z

Added docs/revisit; we could use some documentation about this feature

rmoriz · 2018-12-21T17:27:32Z

The ssh socket is owned and accessibly by root only, e.g.

# syntax=docker/dockerfile:1.0.0-experimental
FROM alpine
RUN apk add --no-cache openssh-client \
   && adduser -h /example -S example example

USER example
RUN --mount=type=ssh ssh-add -l

#8 [3/3] RUN --mount=type=ssh ssh-add -l
#8       digest: sha256:b08486fd10670778bf8ca6bdc0f5950c74035d5c7f458ad24c381b7652ce1dd2
#8         name: "[3/3] RUN --mount=type=ssh ssh-add -l"
#8      started: 2018-12-21 17:24:51.397207862 +0000 UTC
#8 2.410 Error connecting to agent: Permission denied
#8    completed: 2018-12-21 17:24:54.266487196 +0000 UTC
#8     duration: 2.869279334s
#8        error: "executor failed running [/bin/sh -c ssh-add -l]: exit code: 2"

(Docker version 18.09.0, build 4d60db4)

thaJeztah · 2018-12-23T09:46:43Z

@rmoriz could you open an issue for that in the buildkit repository? https://github.com/moby/buildkit

bump up buildkit

846c38c

Signed-off-by: Akihiro Suda <suda.akihiro@lab.ntt.co.jp>

AkihiroSuda requested review from thaJeztah and vdemeester as code owners October 5, 2018 10:48

GordonTheTurtle added the status/0-triage label Oct 5, 2018

vdemeester added status/1-design-review and removed status/0-triage labels Oct 5, 2018

vdemeester requested review from tiborvass, andrewhsu and tonistiigi October 5, 2018 10:52

AkihiroSuda force-pushed the dfssh branch from acb992d to db7399a Compare October 5, 2018 10:56

vdemeester reviewed Oct 5, 2018

View reviewed changes

cpuguy83 approved these changes Oct 9, 2018

View reviewed changes

seemethere approved these changes Oct 9, 2018

View reviewed changes

tiborvass added status/2-code-review and removed status/1-design-review labels Oct 9, 2018

tiborvass approved these changes Oct 9, 2018

View reviewed changes

tiborvass merged commit ab50c2f into docker:master Oct 9, 2018

GordonTheTurtle added this to the 19.03.0 milestone Oct 9, 2018

thaJeztah added area/builder impact/changelog docs/revisit labels Oct 10, 2018

thaJeztah mentioned this pull request Oct 11, 2018

[18.09 backport] builder / buildkit updates #1438

Merged

thaJeztah mentioned this pull request Oct 22, 2018

Forward ssh key agent into container moby/moby#6396

Open

thaJeztah mentioned this pull request Nov 14, 2018

Dockerfile ADD relative symlinks support moby/moby#18789

Open

rmoriz mentioned this pull request Dec 23, 2018

"RUN --mount=type=ssh" only accessible to root moby/buildkit#760

Closed

cleverer mentioned this pull request Jun 21, 2019

Support for --ssh flag drone-plugins/drone-docker#236

Open

thaJeztah mentioned this pull request Dec 30, 2019

docker-compose requires build settings even with --no-build flag moby/moby#40327

Open

thaJeztah mentioned this pull request Jan 27, 2020

Add info on ssh agent usage docker/docs#10184

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

build: add SSH agent socket forwarder (`docker build --ssh $SSHMOUNTID=$SSH_AUTH_SOCK`) #1419

build: add SSH agent socket forwarder (`docker build --ssh $SSHMOUNTID=$SSH_AUTH_SOCK`) #1419

AkihiroSuda commented Oct 5, 2018

AkihiroSuda commented Oct 5, 2018

AkihiroSuda commented Oct 5, 2018

codecov-io commented Oct 5, 2018

vdemeester left a comment

tonistiigi commented Oct 5, 2018

tiborvass commented Oct 5, 2018

tiborvass commented Oct 5, 2018 •

edited

Loading

cpuguy83 commented Oct 6, 2018 •

edited

Loading

thaJeztah commented Oct 6, 2018 via email

tonistiigi commented Oct 7, 2018

tiborvass commented Oct 8, 2018

cpuguy83 left a comment

tiborvass commented Oct 9, 2018

AkihiroSuda commented Oct 10, 2018

seemethere commented Oct 10, 2018 •

edited

Loading

thaJeztah commented Oct 10, 2018

rmoriz commented Dec 21, 2018 •

edited

Loading

thaJeztah commented Dec 23, 2018

build: add SSH agent socket forwarder (docker build --ssh $SSHMOUNTID=$SSH_AUTH_SOCK) #1419

build: add SSH agent socket forwarder (docker build --ssh $SSHMOUNTID=$SSH_AUTH_SOCK) #1419

Conversation

AkihiroSuda commented Oct 5, 2018

AkihiroSuda commented Oct 5, 2018

AkihiroSuda commented Oct 5, 2018

codecov-io commented Oct 5, 2018

Codecov Report

vdemeester left a comment

Choose a reason for hiding this comment

tonistiigi commented Oct 5, 2018

tiborvass commented Oct 5, 2018

tiborvass commented Oct 5, 2018 • edited Loading

cpuguy83 commented Oct 6, 2018 • edited Loading

thaJeztah commented Oct 6, 2018 via email

tonistiigi commented Oct 7, 2018

tiborvass commented Oct 8, 2018

cpuguy83 left a comment

Choose a reason for hiding this comment

tiborvass commented Oct 9, 2018

AkihiroSuda commented Oct 10, 2018

seemethere commented Oct 10, 2018 • edited Loading

thaJeztah commented Oct 10, 2018

rmoriz commented Dec 21, 2018 • edited Loading

thaJeztah commented Dec 23, 2018

build: add SSH agent socket forwarder (`docker build --ssh $SSHMOUNTID=$SSH_AUTH_SOCK`) #1419

build: add SSH agent socket forwarder (`docker build --ssh $SSHMOUNTID=$SSH_AUTH_SOCK`) #1419

tiborvass commented Oct 5, 2018 •

edited

Loading

cpuguy83 commented Oct 6, 2018 •

edited

Loading

seemethere commented Oct 10, 2018 •

edited

Loading

rmoriz commented Dec 21, 2018 •

edited

Loading