Forward ssh key agent into container
It would be nice to be able to forward an ssh key agent into a container during a `run` or `build`. Frequently we need to build source code which exists in a private repository where access is controlled by ssh key. Adding the key file into the container is a bad idea as: 1. You've just lost control of your ssh key 2. Your key might need to be unlocked via passphrase 3. Your key might not be in a file at all, and only accessible through the key agent. You could do something like: ``` # docker run -t -i -v "$SSH_AUTH_SOCK:/tmp/ssh_auth_sock" -e "SSH_AUTH_SOCK=/tmp/ssh_auth_sock" fedora ssh-add -l 2048 82:58:b6:82:c8:89:da:45:ea:9a:1a:13:9c:c3:f9:52 phemmer@whistler (RSA) ``` But: 1. This only works for `docker run`, not `build`. 2. This only works if the docker daemon is running on the same host as the client. The ideal solution is to have the client forward the key agent socket just like `ssh` can. However the difficulty in this is that it would require the remote API build and attach calls to support proxying an arbitrary number of socket streams. Just doing a single 2-way stream wouldn't be sufficient as the ssh key agent is a unix domain socket, and it can have multiple simultaneous connections.
Posted by phemmer on Jun 13, 2014, 2:33 AM
Tags
Related issues
- some bike vendor told me that the biggest problem with regular to ebike conversion was that regular bike frames were not strong enough to...
- I think of this as the kiosk economy.
- What a goofy comment.
- There's lots of evidence for positive influences of Caffeine on the body (some negative as well), especially the brain.
- Compose support in WSLc
- [RFC] Roadmap to v2.0
Raise real-world problems, find people facing the same issue, and discuss solutions.9,500 issues0 comments
support (Other)
some bike vendor told me that the biggest problem with regular to ebike conversion was that regular bike frames were not strong enough to...
I think of this as the kiosk economy.
What a goofy comment.
There's lots of evidence for positive influences of Caffeine on the body (some negative as well), especially the brain.
Compose support in WSLc
[RFC] Roadmap to v2.0
[Feature]: Add TurboQuant Support for KV Cache Quantization
Support for AGENTS.md and .agents/skills/, the community has been asking since August 2025
Forward ssh key agent into container
It would be nice to be able to forward an ssh key agent into a container during a `run` or `build`. Frequently we need to build source code which exists in a private repository where access is controlled by ssh key. Adding the key file into the container is a bad idea as: 1. You've just lost control of your ssh key 2. Your key might need to be unlocked via passphrase 3. Your key might not be in a file at all, and only accessible through the key agent. You could do something like: ``` # docker run -t -i -v "$SSH_AUTH_SOCK:/tmp/ssh_auth_sock" -e "SSH_AUTH_SOCK=/tmp/ssh_auth_sock" fedora ssh-add -l 2048 82:58:b6:82:c8:89:da:45:ea:9a:1a:13:9c:c3:f9:52 phemmer@whistler (RSA) ``` But: 1. This only works for `docker run`, not `build`. 2. This only works if the docker daemon is running on the same host as the client. The ideal solution is to have the client forward the key agent socket just like `ssh` can. However the difficulty in this is that it would require the remote API build and attach calls to support proxying an arbitrary number of socket streams. Just doing a single 2-way stream wouldn't be sufficient as the ssh key agent is a unix domain socket, and it can have multiple simultaneous connections.
Comments (0)
No comments yet. Start the discussion.