SSH agent forwarding to Docker Alpine container from Mac OS

Question

Okay so for several projects I need to access my private repositories, so I'd like to forward the host's SSH Agent to the container to allow retrieving from these private repositories. Eventually I would like to implement this in docker-compose.

I've found a lot of answers and solutions pointing to something like this:

docker run --rm -t -i \
-v $SSH_AUTH_SOCK:/ssh-agent \
-e SSH_AUTH_SOCK=/ssh-agent \
alpine:3.6 sh

But when I run ssh-add -l inside there (after making sure openssh is installed)

I get the following error:

Error connecting to agent: Connection refused

Also tried this within my docker compose setup but it doesn't seem to work like it should. Due to most posts and solutions being several years old I hope someone can help me with accurate up-to-date info.

score 9 · Answer 1 · answered Feb 06 '20 at 15:35

9

According to this issue you can forward your macOS ssh-agent to your docker container by adding -v /run/host-services/ssh-auth.sock:/run/host-services/ssh-auth.sock -e SSH_AUTH_SOCK="/run/host-services/ssh-auth.sock" options to your docker run command, e.g.

docker run --rm -it \
-v /run/host-services/ssh-auth.sock:/run/host-services/ssh-auth.sock \
-e SSH_AUTH_SOCK="/run/host-services/ssh-auth.sock" \
docker_image

answered Feb 06 '20 at 15:35

chris

353
3
8

Can anyone confirm that this works on macOS? I tried it and it doesn't seem to work for me. – Jason Swett Jun 03 '21 at 03:51
It didn't work for me, but this worked: https://github.com/nardeas/ssh-agent – Juan Alonso Oct 26 '22 at 08:30

James Z.M. Gao · Answer 2 · 2022-01-26T02:14:09.923

6

Add keys to the launchd managed ssh-agent:

SSH_AUTH_SOCK=`launchctl getenv SSH_AUTH_SOCK` ssh-add

Forward the launchd managed ssh-agent to docker container:

docker run --rm -it \
-v /run/host-services/ssh-auth.sock:/run/host-services/ssh-auth.sock:ro \
-e SSH_AUTH_SOCK="/run/host-services/ssh-auth.sock" \
image ssh hosts

The mount option and SSH_AUTH_SOCK value in container are all magic constants, do not change them.

launchctl getenv SSH_AUTH_SOCK may output empty string on iTerm2 3.2+ due to the bug. The work around is one of:

A portable way for newer OS (>=10.13 i.e. macOS High Sierra) is launchctl asuser $UID launchctl getenv SSH_AUTH_SOCK, or
For older OS, in iTerm2 > Prefs > Advanced, turn on "Enable multi-server daemon", or
For older OS, in iTerm2 > Prefs > Advanced, turn off "Allow sessions to survive logging out and back in".

NOTE: if the launchctl problem cannot work round, there is another way to forwarding ssh agent via stdio tunnel.

edited Jan 26 '22 at 02:14

answered Sep 23 '20 at 08:15

James Z.M. Gao

516
1
8
13

Thanks for leaving an answer to this question. Can you share your version of your operating system and which docker software and version you are running on it? – hakre Dec 12 '20 at 15:25
OS: MacOS 11.0.1, Docker: 20.10.0 – James Z.M. Gao Dec 12 '20 at 17:13
Thanks. Is this docker for mac or are you running it with a different virtual machine? – hakre Dec 12 '20 at 19:08
Docker for Mac 3.0.0 – James Z.M. Gao Dec 13 '20 at 07:52
The portable solution works great for me without needing to fiddle with iTerm! Great answer! – DoYouEvenCodeBro Jan 25 '22 at 19:53

score 5 · Answer 3 · answered Nov 17 '17 at 16:45

You can mount files, but not sockets - sharing sockets between MacOS through the hypervisor into docker containers is something that isn't supported yet. Various bug reports and acknowledgements exist, and some day it should work.

So in the meantime, you need to have something that forwards network traffic between the container and MacOS. One of the solutions that people point out is docker-ssh-agent-forward.

A different solution would be to run ssh-agent in a container and to access that from MacOS and the other containers - it's probably a bit more invasive but works. A solution is docker-ssh-agent.

Another solution would be to use ngrok: https://ngrok.com/ You can run it from within the container using `ngrok tcp 22`, and it will generate/expose a public FQDN that you can use to connect directly to the container. — DivXZero, Nov 19 '17 at 06:12

SSH agent forwarding to Docker Alpine container from Mac OS

3 Answers3