e942084530
Unlike `docker build --secret`, `docker build --ssh` allows the build container to
use SSH keys with passphrases.
$ eval $(ssh-agent)
$ ssh-add ~/.ssh/id_rsa
(Input your passphrase here)
$ docker build --ssh default=$SSH_AUTH_SOCK ...
This feature requires the daemon with `CapExecMountSSH` build capability (moby/moby#37973) .
Currently, the official Dockerfile frontend does not provide the syntax for using the SSH forwarder.
However, the experimental `RUN --mount=type=ssh` syntax can be enabled by using
the Dockerfile frontend image built with the `BUILDTAGS="dfrunmount dfssh"`, via the `# syntax =` "shebang".
The Dockerfile for the Dockerfile frontend is available at github.com/moby/buildkit/frontend/dockerfile/cmd/dockerfile-frontend)
The pre-built image is also available as `tonistiigi/dockerfile:ssh20181002` .
An example Dockerfile with `RUN --mount=type=ssh`:
# syntax = tonistiigi/dockerfile:ssh20181002
FROM alpine
RUN apk add --no-cache openssh-client
RUN mkdir -p -m 0700 ~/.ssh && ssh-keyscan gitlab.com >> ~/.ssh/known_hosts
RUN --mount=type=ssh ssh git@gitlab.com | tee /hello
# "Welcome to GitLab, @GITLAB_USERNAME_ASSOCIATED_WITH_SSHKEY" should be printed here
More info available at moby/buildkit#608, moby/buildkit#655
Signed-off-by: Akihiro Suda <suda.akihiro@lab.ntt.co.jp>
(cherry picked from commit db7399a016)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
62 lines
1.0 KiB
Go
62 lines
1.0 KiB
Go
package sshforward
|
|
|
|
import (
|
|
io "io"
|
|
|
|
context "golang.org/x/net/context"
|
|
"golang.org/x/sync/errgroup"
|
|
"google.golang.org/grpc"
|
|
)
|
|
|
|
func Copy(ctx context.Context, conn io.ReadWriteCloser, stream grpc.Stream) error {
|
|
g, ctx := errgroup.WithContext(ctx)
|
|
|
|
g.Go(func() (retErr error) {
|
|
p := &BytesMessage{}
|
|
for {
|
|
if err := stream.RecvMsg(p); err != nil {
|
|
if err == io.EOF {
|
|
return nil
|
|
}
|
|
conn.Close()
|
|
return err
|
|
}
|
|
select {
|
|
case <-ctx.Done():
|
|
conn.Close()
|
|
return ctx.Err()
|
|
default:
|
|
}
|
|
if _, err := conn.Write(p.Data); err != nil {
|
|
conn.Close()
|
|
return err
|
|
}
|
|
p.Data = p.Data[:0]
|
|
}
|
|
})
|
|
|
|
g.Go(func() (retErr error) {
|
|
for {
|
|
buf := make([]byte, 32*1024)
|
|
n, err := conn.Read(buf)
|
|
switch {
|
|
case err == io.EOF:
|
|
return nil
|
|
case err != nil:
|
|
return err
|
|
}
|
|
select {
|
|
case <-ctx.Done():
|
|
return ctx.Err()
|
|
default:
|
|
}
|
|
p := &BytesMessage{Data: buf[:n]}
|
|
if err := stream.SendMsg(p); err != nil {
|
|
return err
|
|
}
|
|
}
|
|
})
|
|
|
|
return g.Wait()
|
|
}
|