Unlike `docker build --secret`, `docker build --ssh` allows the build container to use SSH keys with passphrases. $ eval $(ssh-agent) $ ssh-add ~/.ssh/id_rsa (Input your passphrase here) $ docker build --ssh default=$SSH_AUTH_SOCK ... This feature requires the daemon with `CapExecMountSSH` build capability (moby/moby#37973) . Currently, the official Dockerfile frontend does not provide the syntax for using the SSH forwarder. However, the experimental `RUN --mount=type=ssh` syntax can be enabled by using the Dockerfile frontend image built with the `BUILDTAGS="dfrunmount dfssh"`, via the `# syntax =` "shebang". The Dockerfile for the Dockerfile frontend is available at github.com/moby/buildkit/frontend/dockerfile/cmd/dockerfile-frontend) The pre-built image is also available as `tonistiigi/dockerfile:ssh20181002` . An example Dockerfile with `RUN --mount=type=ssh`: # syntax = tonistiigi/dockerfile:ssh20181002 FROM alpine RUN apk add --no-cache openssh-client RUN mkdir -p -m 0700 ~/.ssh && ssh-keyscan gitlab.com >> ~/.ssh/known_hosts RUN --mount=type=ssh ssh git@gitlab.com | tee /hello # "Welcome to GitLab, @GITLAB_USERNAME_ASSOCIATED_WITH_SSHKEY" should be printed here More info available at moby/buildkit#608, moby/buildkit#655 Signed-off-by: Akihiro Suda <suda.akihiro@lab.ntt.co.jp>
62 lines
1.0 KiB
Go
62 lines
1.0 KiB
Go
package sshforward
|
|
|
|
import (
|
|
io "io"
|
|
|
|
context "golang.org/x/net/context"
|
|
"golang.org/x/sync/errgroup"
|
|
"google.golang.org/grpc"
|
|
)
|
|
|
|
func Copy(ctx context.Context, conn io.ReadWriteCloser, stream grpc.Stream) error {
|
|
g, ctx := errgroup.WithContext(ctx)
|
|
|
|
g.Go(func() (retErr error) {
|
|
p := &BytesMessage{}
|
|
for {
|
|
if err := stream.RecvMsg(p); err != nil {
|
|
if err == io.EOF {
|
|
return nil
|
|
}
|
|
conn.Close()
|
|
return err
|
|
}
|
|
select {
|
|
case <-ctx.Done():
|
|
conn.Close()
|
|
return ctx.Err()
|
|
default:
|
|
}
|
|
if _, err := conn.Write(p.Data); err != nil {
|
|
conn.Close()
|
|
return err
|
|
}
|
|
p.Data = p.Data[:0]
|
|
}
|
|
})
|
|
|
|
g.Go(func() (retErr error) {
|
|
for {
|
|
buf := make([]byte, 32*1024)
|
|
n, err := conn.Read(buf)
|
|
switch {
|
|
case err == io.EOF:
|
|
return nil
|
|
case err != nil:
|
|
return err
|
|
}
|
|
select {
|
|
case <-ctx.Done():
|
|
return ctx.Err()
|
|
default:
|
|
}
|
|
p := &BytesMessage{Data: buf[:n]}
|
|
if err := stream.SendMsg(p); err != nil {
|
|
return err
|
|
}
|
|
}
|
|
})
|
|
|
|
return g.Wait()
|
|
}
|