import files
This commit is contained in:
Yann Autissier
@@ -0,0 +1,4 @@
|
||||
# Authors
|
||||
|
||||
* **Andreas Urbanski** <urbanski.andreas@gmail.com> - [@andreasur](https://github.com/andreasur/docker-ssh-agent)
|
||||
* **Yann Autissier** <yann.autissier@gmail.com> - [@aya](https://github.com/aya/docker-ssh-agent)
|
||||
@@ -0,0 +1,10 @@
|
||||
# Changelog
|
||||
|
||||
## Initial Release (Oct 18, 2016)
|
||||
|
||||
* Docker image for SSH agent container
|
||||
|
||||
## v1.0.0 (May 16, 2017)
|
||||
|
||||
* Use alpine latest version
|
||||
* Remove unwanted outputs
|
||||
@@ -0,0 +1,68 @@
|
||||
FROM alpine:latest as dist
|
||||
ARG DOCKER_BUILD_DIR
|
||||
|
||||
LABEL maintainer 1001Pharmacies <technique+docker@1001pharmacies.com>
|
||||
|
||||
# Install dependencies
|
||||
RUN apk add --no-cache \
|
||||
openssh \
|
||||
socat
|
||||
|
||||
# Setup environment variables; export SSH_AUTH_SOCK from socket directory
|
||||
ENV SOCKET_DIR /tmp/ssh-agent
|
||||
ENV SSH_AUTH_SOCK ${SOCKET_DIR}/socket
|
||||
ENV SSH_AUTH_PROXY_SOCK ${SOCKET_DIR}/proxy-socket
|
||||
|
||||
VOLUME ${SOCKET_DIR}
|
||||
|
||||
# Copy entrypoint script to container
|
||||
COPY ${DOCKER_BUILD_DIR}/docker-entrypoint.sh /docker-entrypoint.sh
|
||||
|
||||
ENTRYPOINT ["/docker-entrypoint.sh"]
|
||||
|
||||
CMD ["ssh-agent"]
|
||||
|
||||
FROM dist as local
|
||||
ARG DOCKER_BUILD_DIR
|
||||
ARG UID
|
||||
ARG GID
|
||||
ARG USER
|
||||
ENV UID=${UID}
|
||||
ENV GID=${UID}
|
||||
ENV USER=${USER}
|
||||
LABEL com.1001pharmacies.uid=${UID}
|
||||
LABEL com.1001pharmacies.user=${USER}
|
||||
|
||||
# If we provide a specific UID
|
||||
RUN let $UID >/dev/null 2>&1 \
|
||||
# Remove user with $UID if it is not our $USER
|
||||
&& if [ "$(getent passwd $UID |awk 'BEGIN {FS=":"} {print $1}')" != "$USER" ]; then \
|
||||
sed -i '/^'$(getent passwd $UID |awk 'BEGIN {FS=":"} {print $1}')':x:'$UID':/d' /etc/passwd; \
|
||||
sed -i '/^'$(getent group $GID |awk 'BEGIN {FS=":"} {print $1}')':x:'$GID':/d' /etc/group; \
|
||||
fi \
|
||||
# Force $UID if our $USER already exists
|
||||
&& sed -i 's/^'$USER':x:[0-9]\+:[0-9]\+:/'$USER':x:'$UID':'$GID':/' /etc/passwd \
|
||||
&& sed -i 's/^'$USER':x:[0-9]\+:/'$USER':x:'$GID':/' /etc/group \
|
||||
# Create $USER if it does not exist
|
||||
&& if [ "$(getent passwd $UID)" = "" ]; then \
|
||||
echo "$USER:x:$UID:$GID::/home/$USER:/bin/false" >> /etc/passwd; \
|
||||
echo "$USER:!:$(($(date +%s) / 60 / 60 / 24)):0:99999:7:::" >> /etc/shadow; \
|
||||
echo "$USER:x:$GID:" >> /etc/group; \
|
||||
fi \
|
||||
&& mkdir -p /home/$USER \
|
||||
&& chown $UID:$GID /home/$USER \
|
||||
|| true
|
||||
|
||||
USER $USER
|
||||
|
||||
FROM local as debug
|
||||
ARG DOCKER_BUILD_DIR
|
||||
|
||||
FROM local as tests
|
||||
ARG DOCKER_BUILD_DIR
|
||||
|
||||
FROM tests as preprod
|
||||
ARG DOCKER_BUILD_DIR
|
||||
|
||||
FROM preprod as prod
|
||||
ARG DOCKER_BUILD_DIR
|
||||
@@ -0,0 +1,20 @@
|
||||
# Copyright (c) Andreas Urbanski, 2016
|
||||
#
|
||||
# Permission is hereby granted, free of charge, to any person obtaining a
|
||||
# copy of this software and associated documentation files (the "Software"),
|
||||
# to deal in the Software without restriction, including without limitation
|
||||
# the rights to use, copy, modify, merge, publish, distribute, sublicense,
|
||||
# and/or sell copies of the Software, and to permit persons to whom the
|
||||
# Software is furnished to do so, subject to the following conditions:
|
||||
#
|
||||
# The above copyright notice and this permission notice shall be included
|
||||
# in all copies or substantial portions of the Software.
|
||||
#
|
||||
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
|
||||
# OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
||||
# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
|
||||
# THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
||||
# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
||||
# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
|
||||
# THE SOFTWARE.
|
||||
|
||||
@@ -0,0 +1,72 @@
|
||||
# Docker SSH Agent
|
||||
|
||||
Lets you store your SSH authentication keys in a dockerized ssh-agent that can provide the SSH authentication socket for other containers. Works in OSX and Linux environments.
|
||||
|
||||
## Why?
|
||||
|
||||
On OSX you cannot simply forward your authentication socket to a docker container to be able to e.g clone private repositories that you have access to. You don't want to copy your private key to all containers either. The solution is to add your keys only once to a long-lived ssh-agent container that can be used by other containers and stopped when not needed anymore.
|
||||
|
||||
## How to use
|
||||
|
||||
### 0. Build
|
||||
Navigate to the project directory and launch the following command to build the image:
|
||||
|
||||
```
|
||||
docker build -t docker-ssh-agent:latest -f Dockerfile .
|
||||
```
|
||||
|
||||
### 1. Run a long-lived container
|
||||
|
||||
```
|
||||
docker run -d --name=ssh-agent docker-ssh-agent:latest
|
||||
```
|
||||
|
||||
### 2. Add your ssh keys
|
||||
|
||||
Run a temporary container with volume mounted from host that includes your SSH keys. SSH key id_rsa will be added to ssh-agent (you can replace id_rsa with your key name):
|
||||
|
||||
```
|
||||
docker run --rm --volumes-from=ssh-agent -v ~/.ssh:/root/.ssh -it docker-ssh-agent:latest ssh-add /root/.ssh/id_rsa
|
||||
```
|
||||
|
||||
The ssh-agent container is now ready to use.
|
||||
|
||||
### 3. Add ssh-agent socket to other container:
|
||||
|
||||
#### With docker-compose
|
||||
|
||||
If you're using `docker-compose` this is how you forward the socket to a container:
|
||||
|
||||
```
|
||||
volumes_from:
|
||||
- ssh-agent
|
||||
environment:
|
||||
- SSH_AUTH_SOCK=/tmp/ssh-agent/socket
|
||||
```
|
||||
|
||||
#### Without docker-compose
|
||||
|
||||
Here's an example how to run a Ubuntu container that uses the ssh authentication socket:
|
||||
|
||||
```
|
||||
docker run -it --volumes-from=ssh-agent -e SSH_AUTH_SOCK=/tmp/ssh-agent/socket ubuntu:latest /bin/bash
|
||||
```
|
||||
|
||||
#### Disable host key verification in your containers
|
||||
|
||||
You may wish to disable the ssh host key verification inside your containers to avoid using interactive mode at all.
|
||||
You can do it adding the following configuration in the /etc/ssh/ssh_config file of your containers.
|
||||
|
||||
```
|
||||
Host *
|
||||
UserKnownHostsFile /dev/null
|
||||
StrictHostKeyChecking no
|
||||
```
|
||||
|
||||
### Deleting keys from the container
|
||||
|
||||
Run a temporary container and delete all known keys from ssh-agent:
|
||||
|
||||
```
|
||||
docker run --rm --volumes-from=ssh-agent -it docker-ssh-agent:latest ssh-add -D
|
||||
```
|
||||
Executable
+31
@@ -0,0 +1,31 @@
|
||||
#!/usr/bin/env sh
|
||||
set -euo pipefail
|
||||
set -o errexit
|
||||
|
||||
# Print a debug message if debug mode is on ($DEBUG is not empty)
|
||||
# @param message
|
||||
debug_msg ()
|
||||
{
|
||||
if [ -n "${DEBUG:-}" -a "${DEBUG:-}" != "false" ]; then
|
||||
echo "$@"
|
||||
fi
|
||||
}
|
||||
|
||||
case "$1" in
|
||||
# Start ssh-agent
|
||||
ssh-agent)
|
||||
|
||||
# Create proxy-socket for ssh-agent (to give everyone access to the ssh-agent socket)
|
||||
debug_msg "Create proxy socket..."
|
||||
rm -f ${SSH_AUTH_SOCK} ${SSH_AUTH_PROXY_SOCK} > /dev/null 2>&1
|
||||
socat UNIX-LISTEN:${SSH_AUTH_PROXY_SOCK},perm=0666,fork UNIX-CONNECT:${SSH_AUTH_SOCK} &
|
||||
|
||||
debug_msg "Launch ssh-agent..."
|
||||
exec /usr/bin/ssh-agent -a ${SSH_AUTH_SOCK} -D >/dev/null
|
||||
;;
|
||||
|
||||
*)
|
||||
debug_msg "Exec: $@"
|
||||
exec $@
|
||||
;;
|
||||
esac
|
||||
Reference in New Issue
Block a user