$SSH_AUTH_SOCK is not being forwarded to docker

[mariusgrigaitis]

Expected behavior

OSX ssh-agent socket is available (for mount) in containers

$ docker run -it -v ${SSH_AUTH_SOCK}:${SSH_AUTH_SOCK} -e SSH_AUTH_SOCK="${SSH_AUTH_SOCK}" --rm alpine:3.4 /bin/sh -c "apk update && apk add dropbear-ssh && ssh -T git@github.com"
fetch http://dl-cdn.alpinelinux.org/alpine/v3.4/main/x86_64/APKINDEX.tar.gz
fetch http://dl-cdn.alpinelinux.org/alpine/v3.4/community/x86_64/APKINDEX.tar.gz
v3.4.3-7-g2f47d74 [http://dl-cdn.alpinelinux.org/alpine/v3.4/main]
v3.4.2-11-g9b41a63 [http://dl-cdn.alpinelinux.org/alpine/v3.4/community]
OK: 5968 distinct packages available
(1/2) Installing dropbear (2016.74-r0)
(2/2) Installing dropbear-ssh (2016.74-r0)
Executing busybox-1.24.2-r9.trigger
OK: 5 MiB in 13 packages

Host 'github.com' is not in the trusted hosts file.
(ssh-rsa fingerprint md5 16:27:ac:a5:76:28:2d:36:63:1b:56:4d:eb:df:a6:48)
Do you want to continue connecting? (y/n) yes
Hi <githubusername>! You've successfully authenticated, but GitHub does not provide shell access.

Actual behavior

OSX ssh-agent socket is available, but does not work because it's a socket (unable to connect)

$ docker run -it -v ${SSH_AUTH_SOCK}:${SSH_AUTH_SOCK} -e SSH_AUTH_SOCK="${SSH_AUTH_SOCK}" --rm alpine:3.4 /bin/sh -c "apk update && apk add dropbear-ssh && ssh -T git@github.com"
fetch http://dl-cdn.alpinelinux.org/alpine/v3.4/main/x86_64/APKINDEX.tar.gz
fetch http://dl-cdn.alpinelinux.org/alpine/v3.4/community/x86_64/APKINDEX.tar.gz
v3.4.3-7-g2f47d74 [http://dl-cdn.alpinelinux.org/alpine/v3.4/main]
v3.4.2-11-g9b41a63 [http://dl-cdn.alpinelinux.org/alpine/v3.4/community]
OK: 5968 distinct packages available
(1/2) Installing dropbear (2016.74-r0)
(2/2) Installing dropbear-ssh (2016.74-r0)
Executing busybox-1.24.2-r9.trigger
OK: 5 MiB in 13 packages

Host 'github.com' is not in the trusted hosts file.
(ssh-rsa fingerprint md5 16:27:ac:a5:76:28:2d:36:63:1b:56:4d:eb:df:a6:48)
Do you want to continue connecting? (y/n) yes
ssh: Failed to connect to agent

ssh: Connection to git@github.com:22 exited: No auth methods could be used.

Information

https://forums.docker.com/t/can-we-re-use-the-osx-ssh-agent-socket-in-a-container/8152

It would be great if Docker for Mac would forward osx ssh-agent's socket into VM, just like how it does with docker.sock. Generic solution for socket would also help a lot.

[samoht]

Have you checked https://github.com/avsm/docker-ssh-agent-forward ? It seems to do what you want.

[mariusgrigaitis]

Solution that you provided works, but it's not convenient / experimental

• It requires to append additional parameters on every docker run command which complicates stuff like running containers through docker-compose
• It runs separate ssh-agent and shares your local key to that agent. What if your key is encrypted?
• We want to make our scripts / files as much platform-independent as possible and this complicates things

Would be a lot better if docker for mac provided native support for ssh agent forwarding or socket forwarding in general as mentioned in #483

P.S. currently docker.sock is forwarded, it's probably not that hard to achieve same solution for other sockets too.

[trinitronx]

I've run into problems trying to support the ssh-agent SSH_AUTH_SOCK specifically with "Docker for Mac".

The problem appears to be due to osxfuse not supporting socket connections across the OS X Host / Docker Container boundary.

As the documentation states:

Socket files and named pipes only transmit between containers and between OS X processes – no transmission across the hypervisor is supported, yet.

So I can mount in the ssh-agent socket, it appears inside the container fine. However, accessing it via ssh-add -l always results in: "Could not open a connection to your authentication agent."

For example, I can find my SSH_AUTH_SOCK file on the OSX host (e.g.: /private/tmp/com.apple.launchd.abCDEfghiJ/Listeners)
Then, I can run a container using "Docker for Mac" by passing in the volume mount & environment variable arguments like: -v /private/tmp/com.apple.launchd.abCDEfghiJ:/ssh-agent -e SSH_AUTH_SOCK=/ssh-agent/Listeners

Inside the container, the socket appears as a socket owned by root. I'm running as root in the container & have rw access. However, ssh-add cannot communicate over the socket.

[root@62b57964834a ansible]# env | grep -i ssh
SSH_AUTH_SOCK=/ssh-agent/Listeners
[root@62b57964834a ansible]# ls -l $SSH_AUTH_SOCK
srw-rw-rw- 1 root root 0 Feb  1 17:57 /ssh-agent/Listeners
[root@62b57964834a]# whoami
root
[root@62b57964834a]# ssh-add -l
Could not open a connection to your authentication agent.

[samoht]

@mariusgrigaitis @trinitronx I was maybe not very clear, but yes support for ssh agent forwarder is planned on our roadmap and is indeed very related to #483. I was just pointing out a possible workaround which works today while we implement the feature.

[JoeNyland]

Ugh, I've just been caught out by this limitation of Docker for Mac 😞 I'm surprised to see that this has still not been resolved 👎

[andytson]

I'm not surprised at all. It's a complex issue that goes beyond what normal VM environments can support. I'd really like to have this feature, but I'm not going to assume an easy fix solution is possible.

[evgenysalnikov]

• up

[isodude]

The clean way of working around this is to have a docker being responsible for the ssh-agent.

• Start a docker with a volume /agent and entrypoint ssh-agent
• Use docker cp to copy the private key to the container
• ssh-add the key and remove it.
• Use --volume-from instead of mounting the ssh-socket from localhost.

If you do it as a bash function the magic stuff can happen in the shadows.