Pull ssh keys in docker container at runtime

Question

I am creating a nodejs application that will integrate with Git repo and perform operations such as push, pull commit etc. I am in the process of moving the app to Docker. However I can't find a way to put ssh keys in the docker image at runtime. I want to avoid copying the ssh key at build time in the docker image for security reasons.

I have tried passing the ssh key as an env variable at runtime like :

docker run -i -t -e KEY="sshkey" imagename

And in node.js manually creating the ssh folder and ssh key

mkdirSync('/root/.ssh/', (err) => {
    writeFileSync('/root/.ssh/id_rsa.pub', sshKey, (err) => {
    })
})

However this doesn't seem to be working, I still get permission errors when trying to clone the repo.

Do I need to do something to load the ssh keys so they can be used by git?
Is there a way to do it using Dockerfile. I know that I can add it on build, time, but haven't found a way to do it at runtime.
How can I inspect the fs of a running docker container?

Can't you just do a volume/file mount?

Oliver Charlesworth
– Oliver Charlesworth

2016-09-01 13:17:49 +00:00
Commented Sep 1, 2016 at 13:17 — Oliver Charlesworth
– Oliver Charlesworth, Commented Sep 1, 2016 at 13:17

Mark O'Connor · Accepted Answer · 2016-09-02 06:53:46Z

2

The following contrived example demonstrates how a private key on the host machine can be read from within a container.

docker run -it --rm -v ~/.ssh/id_rsa:/root/.ssh/id_rsa:ro ubuntu cat /root/.ssh/id_rsa

This should let a process running as root authenticate with your credential.

edited Sep 2, 2016 at 6:53

answered Sep 1, 2016 at 23:20

Mark O'Connor

78.3k11 gold badges145 silver badges189 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

jdno · Accepted Answer · 2016-09-01 13:26:19Z

0

You need to add your private key if you want to authenticate via SSH, not your public key. In your case, that's probably the file id_rsa. The public key is used by the server to verify your identity.
The Dockerfile is only used for the build, so there is no way to use it to do anything at runtime. I think your approach with the environment variable is reasonable...
You can connect to the container via docker exec, open the bash and interact with the filesystem like you normally would:
```
docker exec -it imagename /bin/bash
```
This assumes that you are running a system with a bash. Otherwise, try /bin/sh.

answered Sep 1, 2016 at 13:26

jdno

4,3941 gold badge25 silver badges27 bronze badges

1 Comment

Alex Over a year ago

Thanks for that, using env variables and the private key worked. A couple of things that I had to solve in case anyone else tries it: 1. create the key file using the Dockerfile 2.give the correct permissions to the file so you can write from your node.js app

Mohammad Azim · Accepted Answer · 2017-09-25 13:41:34Z

0

For non root user at host and docker:

docker run -v /home/<host user>/.ssh:/home/<docker user>/.ssh <image>

answered Sep 25, 2017 at 13:41

Mohammad Azim

3,0231 gold badge25 silver badges24 bronze badges

Collectives™ on Stack Overflow

Pull ssh keys in docker container at runtime

3 Answers 3

Comments

1 Comment

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

1 Comment

Comments

Your Answer

Sign up or log in

Post as a guest

Related