GetAuthSSHCmd wraps the command to be run inside the SSH auth container. SSH auth container mounts the SSH keys into /tmp/sshtmp location, copies them to ~/.ssh (to avoid permission issues with mounted volumes), sets ownership and permissions, and filters the private keys from provided files. We hav
(command string)
| 194 | // "ssh-add" - adds all found private keys to ssh-agent |
| 195 | // "//test.expect.passphrase" - used for testing, adds a single key with passphrase |
| 196 | func GetAuthSSHCmd(command string) string { |
| 197 | uid, gid, username := dockerutil.GetContainerUser() |
| 198 | |
| 199 | commandToRun := command |
| 200 | if dockerutil.IsDockerRootless() { |
| 201 | // Run command as container user, not root |
| 202 | commandToRun = fmt.Sprintf("setpriv --reuid=%s --regid=%s --init-groups -- %s", uid, gid, command) |
| 203 | } |
| 204 | |
| 205 | if command == "ssh-add" { |
| 206 | commandToRun = fmt.Sprintf(` |
| 207 | for key in "${keys[@]}"; do \ |
| 208 | # Show which key is being added |
| 209 | printf "%[1]s\n" "$key" >&2; \ |
| 210 | # Add the key to ssh-agent or exit immediately on failure |
| 211 | %[2]s "$key" || exit $?; \ |
| 212 | done`, util.ColorizeText("Adding key %s", "yellow"), commandToRun) |
| 213 | } |
| 214 | |
| 215 | return fmt.Sprintf(` |
| 216 | # Copy SSH files and set proper ownership and permissions |
| 217 | cp -r /tmp/sshtmp /home/%[1]s/.ssh && \ |
| 218 | chown -R %[2]s:%[3]s /home/%[1]s/.ssh && \ |
| 219 | chmod -R go-rwx /home/%[1]s/.ssh && \ |
| 220 | cd /home/%[1]s/.ssh && \ |
| 221 | # Find all private key files |
| 222 | mapfile -t keys < <(grep -l '^-----BEGIN .*PRIVATE KEY-----' *) && \ |
| 223 | # Verify at least one key exists |
| 224 | ((${#keys[@]})) || { echo "No SSH private keys found." >&2; exit 1; } && \ |
| 225 | %[4]s`, username, uid, gid, commandToRun) |
| 226 | } |
| 227 | |
| 228 | // runSSHAuthContainer runs the SSH auth container using Docker client API |
| 229 | func runSSHAuthContainer(keys []string) (int, error) { |