CODEWITHSUNDEEP
dockerdocker-composemacos-sierraalpine-linuxssh-agent
TheWolfNL
TheWolfNL

Reputation: 1283

SSH agent forwarding to Docker Alpine container from Mac OS

Okay so for several projects I need to access my private repositories, so I'd like to forward the host's SSH Agent to the container to allow retrieving from these private repositories. Eventually I would like to implement this in docker-compose.

I've found a lot of answers and solutions pointing to something like this:

docker run --rm -t -i \
-v $SSH_AUTH_SOCK:/ssh-agent \
-e SSH_AUTH_SOCK=/ssh-agent \
alpine:3.6 sh

But when I run ssh-add -l inside there (after making sure openssh is installed)

I get the following error:

Error connecting to agent: Connection refused

Also tried this within my docker compose setup but it doesn't seem to work like it should. Due to most posts and solutions being several years old I hope someone can help me with accurate up-to-date info.

Upvotes: 17

Views: 14244

Answers (3)

James Z.M. Gao
James Z.M. Gao

Reputation: 646

  1. Add keys to the launchd managed ssh-agent:
SSH_AUTH_SOCK=`launchctl getenv SSH_AUTH_SOCK` ssh-add
  1. Forward the launchd managed ssh-agent to docker container:
docker run --rm -it \
-v /run/host-services/ssh-auth.sock:/run/host-services/ssh-auth.sock:ro \
-e SSH_AUTH_SOCK="/run/host-services/ssh-auth.sock" \
image ssh hosts

The mount option and SSH_AUTH_SOCK value in container are all magic constants, do not change them.

  1. launchctl getenv SSH_AUTH_SOCK may output empty string on iTerm2 3.2+ due to the bug. The work around is one of:
  • A portable way for newer OS (>=10.13 i.e. macOS High Sierra) is launchctl asuser $UID launchctl getenv SSH_AUTH_SOCK, or
  • For older OS, in iTerm2 > Prefs > Advanced, turn on "Enable multi-server daemon", or
  • For older OS, in iTerm2 > Prefs > Advanced, turn off "Allow sessions to survive logging out and back in".

NOTE: if the launchctl problem cannot work round, there is another way to forwarding ssh agent via stdio tunnel.

Upvotes: 9

chris
chris

Reputation: 413

According to this issue you can forward your macOS ssh-agent to your docker container by adding -v /run/host-services/ssh-auth.sock:/run/host-services/ssh-auth.sock -e SSH_AUTH_SOCK="/run/host-services/ssh-auth.sock" options to your docker run command, e.g.

docker run --rm -it \
-v /run/host-services/ssh-auth.sock:/run/host-services/ssh-auth.sock \
-e SSH_AUTH_SOCK="/run/host-services/ssh-auth.sock" \
docker_image

Upvotes: 14

cdegroot
cdegroot

Reputation: 1805

You can mount files, but not sockets - sharing sockets between MacOS through the hypervisor into docker containers is something that isn't supported yet. Various bug reports and acknowledgements exist, and some day it should work.

So in the meantime, you need to have something that forwards network traffic between the container and MacOS. One of the solutions that people point out is docker-ssh-agent-forward.

A different solution would be to run ssh-agent in a container and to access that from MacOS and the other containers - it's probably a bit more invasive but works. A solution is docker-ssh-agent.

Upvotes: 8

Related Questions