How to deploy code from Github using deploy key in Docker?

Question

I want to pull code from Github into my Docker image while building. I have a deploy key generated from the repository, but it seems to me the ssh-agent is not working on my Docker image.

What I did (my Dockerfile):

FROM python:2.7-stretch
ADD ./id_rsa /root/.ssh/id_rsa
RUN eval "$(ssh-agent -s)"
RUN ssh-add -K /root/.ssh/id_rsa

Output:

Step 12/22 : RUN eval "$(ssh-agent -s)"
 ---> Running in f9ad80981cee
Agent pid 6
Removing intermediate container f9ad80981cee
 ---> d773f7ce5917
Step 13/22 : RUN ssh-add -K /root/.ssh/id_rsa
 ---> Running in 95efeed6a7ad
Could not open a connection to your authentication agent.
The command '/bin/sh -c ssh-add -K /root/.ssh/id_rsa' returned a non-zero code: 2

As you can see, ssh-agent is started, but keys are not adding in it.

If I skip the ssh-add step then my git pull fails later because of privileges, which is failing as expected as no authentication happened.

zinovyev · Accepted Answer · 2018-04-24 07:56:47Z

4

Actually you don't need to copy your private key to your container (and you better not do it).

All you need is the ssh-agent installed and launched on both: your host and your docker container then all you need to do is to mount the ssh-aget's socket file:

If you are using docker-compose:

environment:
  - "SSH_AUTH_SOCK=/tmp/ssh-agent"
volumes:
  - $SSH_AUTH_SOCK:/tmp/ssh-agent

With docker:

docker run -v $SSH_AUTH_SOCK:/tmp/ssh-agent 8be57bbc9561 sleep 1000000 # 8be57bbc9561 is an id of the image
docker exec -it -e SSH_AUTH_SOCK=/tmp/ssh-agent 5b6f4a8f8661 /bin/ash # 5b6f4a8f8661 is an id of the container

P.S

As of your case, I think the problem can be related to the export command which is normally evaled from the code from the output of the ssh-agent.

It should provide you two variables: SSH_AUTH_SOCK and SSH_AGENT_PID. But the export won't persist across images.

You've used RUN two times: first for launching the ssh-agent and exporting variables and then for adding a key. And each Dockerfile directive will generate an intermediate container (and export won't persist across them).

If you still want to use it this way (which I stronly recommend to avoid), you can try to bind both command in a single RUN:

RUN eval "$(ssh-agent -s)" && ssh-add /root/.ssh/id_rsa

I've written a short post based on my answer above.

edited Apr 24, 2018 at 7:56

answered Apr 12, 2018 at 19:03

zinovyev

2,2111 gold badge25 silver badges34 bronze badges

Sign up to request clarification or add additional context in comments.

6 Comments

Harsh M Over a year ago

Okay, I got it, so to avoid putting keys, and I do have intention of using docker compose later on as I have multiple services, I was just starting up. So coming to the point, I tried docker build . -v $SSH_AUTH_SOCK:/tmp/ssh-agent -e SSH_AUTH_SOCK=/tmp/ssh-agent. It resulted in: unknown shorthand flag: 'v' in -v See 'docker build --help'. Can you point me to appropriate documentation of how to do the way you are suggesting? Thanks a lot for all the help :) and is it possible to testing the docker file with docker build and then later on writing docker compose?

zinovyev Over a year ago

@HarshM the -v and -e flags are used with docker run command, not with docker build because the mounted volumes and environment variables are related to container's runtime, not to the image itself.

zinovyev Over a year ago

Yes it is possible and actually it also works so. Docker compose often uses the Dockerfile underneath to build and launch your service. It just helps you to define these flags withiin a pretty formatted configuration file and to define some related services too.

Harsh M Over a year ago

I got it, But I incorporated your suggestion and now using CodeBuild as build tool. and not using ssh to fetch code in docker image. Thanks.

parean Over a year ago

I don't get it. For "docker run" you need image, but ssh is used during the build stage. How can I mount the ssh-aget's socket file while I build image?

|

zstate · Accepted Answer · 2018-04-12 21:06:26Z

0

From this link:

The -K option is Apple's standard version of ssh-add, which stores the passphrase in your keychain for you when you add an ssh key to the ssh-agent.

If you don't have Apple's standard version installed, you may receive an error.

Try to remove the -K option and build it again. The following worked for me:

FROM python:2.7-stretch
ADD ./id_rsa /root/.ssh/id_rsa
RUN eval "$(ssh-agent -s)" && ssh-add /root/.ssh/id_rsa

answered Apr 12, 2018 at 21:06

zstate

2,0751 gold badge19 silver badges20 bronze badges

Comments

ajankuv · Accepted Answer · 2018-04-12 19:06:19Z

-1

Edit ~/.ssh/config

Add with your new key

Host github.com
IdentityFile /root/.ssh/id_rsa

answered Apr 12, 2018 at 19:06

ajankuv

4973 silver badges22 bronze badges

1 Comment

Bas Peeters Over a year ago

This would mean using a key which is not password protected.

Collectives™ on Stack Overflow

How to deploy code from Github using deploy key in Docker?

3 Answers 3

6 Comments

Comments

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

6 Comments

Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related